Linter: gosec, Rule: G601 - Implicit memory aliasing of items from a range statement. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G601 - Implicit memory aliasing of items from a range statement

Rule is mapped to CWE-118: Incorrect Access of Indexable Resource ('Range Error').

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule following findings were found in current code:

plugins/inputs/clickhouse/clickhouse.go:144:30         gosec  G601: Implicit memory aliasing in for loop.
plugins/inputs/clickhouse/clickhouse.go:150:36         gosec  G601: Implicit memory aliasing in for loop.
plugins/inputs/mongodb/mongodb_data.go:303:33          gosec  G601: Implicit memory aliasing in for loop.
plugins/inputs/mongodb/mongodb_data.go:319:34          gosec  G601: Implicit memory aliasing in for loop.
plugins/inputs/mongodb/mongodb_data.go:336:35          gosec  G601: Implicit memory aliasing in for loop.
plugins/inputs/mongodb/mongodb_data.go:352:34          gosec  G601: Implicit memory aliasing in for loop.
plugins/inputs/ras/ras_test.go:17:22                   gosec  G601: Implicit memory aliasing in for loop.
plugins/inputs/ras/ras_test.go:98:22                   gosec  G601: Implicit memory aliasing in for loop.
plugins/inputs/vsphere/endpoint.go:1221:52             gosec  G601: Implicit memory aliasing in for loop.
plugins/outputs/azure_monitor/azure_monitor.go:284:34  gosec  G601: Implicit memory aliasing in for loop.
plugins/parsers/collectd/parser_test.go:304:28         gosec  G601: Implicit memory aliasing in for loop.

Additional info

For this rule no additional configuration can be provided.

[powersj]

+1

[srebhan]

Definitively +1! I've hit this so many times...