Linter: gosec, Rule: G113 - Usage of Rat.SetString in math/big with an overflow (CVE-2022-23772). Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G113 - Usage of Rat.SetString in math/big with an overflow (CVE-2022-23772)

Rule is mapped to CWE-190: Integer Overflow or Wraparound.

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule following finding was found in current code:

internal/internal.go:317:15  gosec  G113: Potential uncontrolled memory consumption in Rat.SetString (CVE-2022-23772)

Additional info

For this rule no additional configuration can be provided.

[powersj]

+1

[zak-pawel]

Potential large memory consumption for this method was fixed in Go 1.17.7 and Go 1.16.14:
https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ

Since Telegraf requires Go version >= 1.20, I believe we don't want to enable this one.

@powersj What do you think?

[powersj]

sounds good to omit this one then