05a0354c85
Drop the stray em-dash (envreads) and arrow (reinvented) separators so all findings use the two canonical shapes: "file:line snippet" and "file:line [rule] detail". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
1.1 KiB
Go
37 lines
1.1 KiB
Go
package main
|
|
|
|
func init() {
|
|
register(Check{
|
|
Seq: 10,
|
|
ID: "1",
|
|
Title: "Secret env var reads outside config.Load()",
|
|
Run: func(ctx *ScanContext, rep *Reporter) {
|
|
var envViolations []envViolation
|
|
for _, target := range ctx.backendTargets {
|
|
for _, v := range checkEnvReads(target.root) {
|
|
v.file = prefixDisplayPath(target.display, v.file)
|
|
envViolations = append(envViolations, v)
|
|
}
|
|
}
|
|
for _, target := range ctx.pluginTargets {
|
|
for _, v := range checkEnvReads(target.root) {
|
|
v.file = prefixDisplayPath(target.display, v.file)
|
|
envViolations = append(envViolations, v)
|
|
}
|
|
}
|
|
if len(envViolations) > 0 {
|
|
rep.Fail("%d secret env var read(s) outside config.Load() — secrets must flow through Config → DI", len(envViolations))
|
|
for _, v := range envViolations {
|
|
rep.Findingf("%s:%d os.Getenv(%q)", v.file, v.line, v.envVar)
|
|
}
|
|
} else {
|
|
if len(ctx.pluginTargets) > 0 {
|
|
rep.OK("No secret env var reads outside config.Load() (%d plugin roots scanned)", len(ctx.pluginTargets))
|
|
} else {
|
|
rep.OK("No secret env var reads outside config.Load()")
|
|
}
|
|
}
|
|
},
|
|
})
|
|
}
|