gosec-ci.json
Rama main · réplica de lectura del repositorio original.
{
"Golang errors": {},
"Issues": [
{
"severity": "HIGH",
"confidence": "MEDIUM",
"cwe": {
"id": "190",
"url": "https://cwe.mitre.org/data/definitions/190.html"
},
"rule_id": "G115",
"details": "integer overflow conversion int64 -\u003e uint64",
"file": "/src/pkg/sodp/server.go",
"code": "724: \tcase int64:\n725: \t\tsinceVersion = uint64(v)\n726: \tcase float64:\n",
"line": "725",
"column": "24",
"nosec": false,
"suppressions": null
},
{
"severity": "HIGH",
"confidence": "MEDIUM",
"cwe": {
"id": "190",
"url": "https://cwe.mitre.org/data/definitions/190.html"
},
"rule_id": "G115",
"details": "integer overflow conversion int -\u003e uint32",
"file": "/src/engine/ndjson_transfer.go",
"code": "189: \t}\n190: \tif err := binary.Write(f, binary.LittleEndian, uint32(len(schemaJSON))); err != nil { //nolint:gosec\n191: \t\treturn err\n",
"line": "190",
"column": "55",
"nosec": false,
"suppressions": null
},
{
"severity": "HIGH",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G704",
"details": "SSRF via taint analysis",
"file": "/src/pkg/fetchers/rest_fetcher.go",
"code": "312: \t}\n313: \tresp, err := client.Do(req)\n314: \tif err != nil {\n",
"line": "313",
"column": "24",
"nosec": false,
"suppressions": null
},
{
"severity": "HIGH",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G704",
"details": "SSRF via taint analysis",
"file": "/src/pkg/fetchers/rest_fetcher.go",
"code": "271: \n272: \treq, err := http.NewRequest(options.Method, resolvedURL, nil)\n273: \tif err != nil {\n",
"line": "272",
"column": "29",
"nosec": false,
"suppressions": null
},
{
"severity": "HIGH",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G704",
"details": "SSRF via taint analysis",
"file": "/src/api/handlers_connection.go",
"code": "436: \tclient := netguard.Outbound().Client(5 * time.Second)\n437: \tresp, err := client.Do(req)\n438: \tif err != nil {\n",
"line": "437",
"column": "24",
"nosec": false,
"suppressions": null
},
{
"severity": "HIGH",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G704",
"details": "SSRF via taint analysis",
"file": "/src/api/handlers_connection.go",
"code": "411: \n412: \treq, err := http.NewRequestWithContext(ctx, \"GET\", url, nil)\n413: \tif err != nil {\n",
"line": "412",
"column": "40",
"nosec": false,
"suppressions": null
},
{
"severity": "HIGH",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G702",
"details": "Command injection via taint analysis",
"file": "/src/cmd/dev.go",
"code": "172: \t// and avoid re-initializing the store on every change.\n173: \tcmd := exec.Command(os.Args[0], \"import\", path, \"--db\", dbPath)\n174: \tcmd.Stdout = os.Stdout\n",
"line": "173",
"column": "21",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "400",
"url": "https://cwe.mitre.org/data/definitions/400.html"
},
"rule_id": "G118",
"details": "context cancellation function returned by WithCancel/WithTimeout/WithDeadline is not called",
"file": "/src/cmd/serve.go",
"code": "911: \telector := store.NewPostgresLeaderElector(db, holderID, store.DefaultLeaseDuration, store.DefaultRenewInterval)\n912: \telectCtx, cancel := context.WithCancel(context.Background())\n913: \n",
"line": "912",
"column": "40",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G705",
"details": "XSS via taint analysis",
"file": "/src/api/handlers_pipeline.go",
"code": "994: \tw.Header().Set(\"Content-Disposition\", fmt.Sprintf(`attachment; filename=\"%s.yaml\"`, safeName))\n995: \tw.Write(yamlData) //nolint:errcheck\n996: }\n",
"line": "995",
"column": "9",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "78",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
"rule_id": "G204",
"details": "Subprocess launched with variable",
"file": "/src/pkg/secrets/k8s.go",
"code": "98: \n99: \tcmd := exec.CommandContext(ctx, \"kubectl\", args...)\n100: \tout, err := cmd.Output()\n",
"line": "99",
"column": "9",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "78",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
"rule_id": "G204",
"details": "Subprocess launched with variable",
"file": "/src/engine/node_dbt.go",
"code": "98: \t// outlived both, which no other external call in the engine allows.\n99: \tcmd := exec.CommandContext(r.ctx, \"dbt\", args...)\n100: \tcmd.Dir = projectDir\n",
"line": "99",
"column": "9",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "78",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
"rule_id": "G204",
"details": "Subprocess launched with variable",
"file": "/src/engine/compile.go",
"code": "68: \n69: \tcmd := exec.CommandContext(ctx, \"python3\", \"-c\", script)\n70: \toutput, err := cmd.Output()\n",
"line": "69",
"column": "9",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "78",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
"rule_id": "G204",
"details": "Subprocess launched with variable",
"file": "/src/engine/codenode.go",
"code": "164: \n165: \tcmd := exec.CommandContext(ctx, pythonPath, wrapperFile)\n166: \t// codeexec.WorkerEnv(), not os.Environ(): a code node runs\n",
"line": "165",
"column": "9",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "78",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
"rule_id": "G204",
"details": "Subprocess launched with variable",
"file": "/src/cmd/dev.go",
"code": "185: \t\t// SDK not installed or compile failed — try python3 -m brokoli.\n186: \t\tcmd = exec.Command(\"python3\", \"-m\", \"brokoli\", \"compile\", path)\n187: \t\toutput, err = cmd.Output()\n",
"line": "186",
"column": "9",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "78",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
"rule_id": "G204",
"details": "Subprocess launched with variable",
"file": "/src/cmd/dev.go",
"code": "181: \t// Try the brokoli Python SDK CLI first.\n182: \tcmd := exec.Command(\"brokoli\", \"compile\", path)\n183: \toutput, err := cmd.Output()\n",
"line": "182",
"column": "9",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "78",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
"rule_id": "G204",
"details": "Subprocess launched with a potential tainted input or cmd arguments",
"file": "/src/pkg/plugins/runner.go",
"code": "494: \targs = append(args, string(CmdSpec))\n495: \tproc := exec.CommandContext(ctx, r.manifest.BinaryPath(), args...)\n496: \tproc.Env = minimalEnv()\n",
"line": "495",
"column": "10",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "78",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
"rule_id": "G204",
"details": "Subprocess launched with a potential tainted input or cmd arguments",
"file": "/src/pkg/plugins/runner.go",
"code": "160: \n161: \tproc := exec.CommandContext(ctx, r.manifest.BinaryPath(), args...)\n162: \t// Preserve PATH etc. but don't leak the host's entire environment —\n",
"line": "161",
"column": "10",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "78",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
"rule_id": "G204",
"details": "Subprocess launched with a potential tainted input or cmd arguments",
"file": "/src/cmd/dev.go",
"code": "172: \t// and avoid re-initializing the store on every change.\n173: \tcmd := exec.Command(os.Args[0], \"import\", path, \"--db\", dbPath)\n174: \tcmd.Stdout = os.Stdout\n",
"line": "173",
"column": "9",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "78",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
"rule_id": "G204",
"details": "Subprocess launched with a potential tainted input or cmd arguments",
"file": "/src/cmd/dev.go",
"code": "61: \t\tserverArgs := []string{\"serve\", \"--port\", fmt.Sprintf(\"%d\", devPort), \"--db\", devDB}\n62: \t\tserverProc := exec.Command(os.Args[0], serverArgs...)\n63: \t\tserverProc.Stdout = os.Stdout\n",
"line": "62",
"column": "17",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G201",
"details": "SQL string formatting",
"file": "/src/store/alert_incidents.go",
"code": "328: \tn := len(args)\n329: \tquery := fmt.Sprintf(`UPDATE alerts SET %s WHERE id = %s AND org_id = %s`,\n330: \t\tset, phAt(dialect, n+1), phAt(dialect, n+2))\n331: \targs = append(args, alertID, orgID)\n",
"line": "329-330",
"column": "11",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G201",
"details": "SQL string formatting",
"file": "/src/engine/pushdown.go",
"code": "282: \t\ttruncate, _ := node.Config[\"truncate\"].(bool)\n283: \t\tclear := fmt.Sprintf(\"DELETE FROM %s\", target)\n284: \t\tif truncate {\n",
"line": "283",
"column": "12",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G201",
"details": "SQL string formatting",
"file": "/src/engine/pushdown.go",
"code": "257: \t}\n258: \tinsert := fmt.Sprintf(\"INSERT INTO %s (%s) SELECT %s FROM (%s) AS brokoli_pushdown\",\n259: \t\ttarget, strings.Join(cols, \", \"), strings.Join(cols, \", \"), in.Query)\n260: \n",
"line": "258-259",
"column": "12",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G201",
"details": "SQL string formatting",
"file": "/src/engine/bulk_mysql.go",
"code": "234: \t}\n235: \tstmt := fmt.Sprintf(\n236: \t\t\"LOAD DATA LOCAL INFILE 'Reader::%s' INTO TABLE %s CHARACTER SET utf8mb4 FIELDS TERMINATED BY '\\\\t' ESCAPED BY '\\\\\\\\' LINES TERMINATED BY '\\\\n' (%s)\",\n237: \t\tname, d.quoteIdent(table), strings.Join(quotedCols, \", \"))\n238: \n",
"line": "235-237",
"column": "10",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G201",
"details": "SQL string formatting",
"file": "/src/cmd/migrate.go",
"code": "216: \t}\n217: \tinsertSQL := fmt.Sprintf(\"INSERT INTO %s (%s) VALUES (%s)\",\n218: \t\ttable, columns, strings.Join(placeholders, \", \"))\n219: \n",
"line": "217-218",
"column": "15",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G201",
"details": "SQL string formatting",
"file": "/src/cmd/migrate.go",
"code": "199: \tcols := strings.Split(columns, \", \")\n200: \tselectSQL := fmt.Sprintf(\"SELECT %s FROM %s\", columns, table)\n201: \n",
"line": "200",
"column": "15",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/sqlite.go",
"code": "2153: \n2154: \tquery := `\n2155: \t\tSELECT pipeline_id, node_id, profile, schema_snapshot, run_id, created_at\n2156: \t\tFROM (\n2157: \t\t\tSELECT r.pipeline_id AS pipeline_id, np.node_id AS node_id, np.profile AS profile,\n2158: \t\t\t np.schema_snapshot AS schema_snapshot, np.run_id AS run_id, np.created_at AS created_at,\n2159: \t\t\t ROW_NUMBER() OVER (\n2160: \t\t\t PARTITION BY r.pipeline_id, np.node_id\n2161: \t\t\t ORDER BY np.created_at DESC\n2162: \t\t\t ) AS rank\n2163: \t\t\tFROM node_profiles np\n2164: \t\t\tJOIN runs r ON r.id = np.run_id\n2165: \t\t\tWHERE r.pipeline_id IN (` + strings.Join(placeholders, \",\") + `)\n2166: \t\t)\n2167: \t\tWHERE rank = 1\n2168: \t`\n2169: \trows, err := s.db.Query(query, args...)\n",
"line": "2154-2168",
"column": "11",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/sqlite.go",
"code": "1517: \t}\n1518: \trows, err := s.db.Query(`\n1519: \t\tSELECT id, run_id, node_id, status, row_count, started_at, duration_ms, error, attempt, queue_ms\n1520: \t\tFROM (\n1521: \t\t\tSELECT id, run_id, node_id, status, row_count, started_at, duration_ms, error, attempt, queue_ms,\n1522: \t\t\t ROW_NUMBER() OVER (PARTITION BY run_id, node_id ORDER BY attempt DESC) AS rn\n1523: \t\t\tFROM node_runs WHERE run_id IN (`+strings.Join(placeholders, \",\")+`)\n1524: \t\t) WHERE rn = 1`, args...)\n1525: \tif err != nil {\n",
"line": "1518-1524",
"column": "26",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/sqlite.go",
"code": "1026: \t// Rank pending runs first, then started runs newest-first, consistently with Postgres.\n1027: \tquery := `\n1028: \t\tSELECT id, pipeline_id, status, started_at, finished_at, trace_id, error, params, pipeline_version, resumed_from_run_id, org_id, cancel_requested, trigger_type, data_interval_start, data_interval_end\n1029: \t\tFROM (\n1030: \t\t\tSELECT id, pipeline_id, status, started_at, finished_at, trace_id, error, params, pipeline_version, resumed_from_run_id, org_id, cancel_requested, trigger_type, data_interval_start, data_interval_end,\n1031: \t\t\t ROW_NUMBER() OVER (\n1032: \t\t\t PARTITION BY pipeline_id\n1033: \t\t\t ORDER BY (started_at IS NULL) DESC, started_at DESC, id DESC\n1034: \t\t\t ) AS rank\n1035: \t\t\tFROM runs\n1036: \t\t\tWHERE pipeline_id IN (` + strings.Join(placeholders, \",\") + `)\n1037: \t\t)\n1038: \t\tWHERE rank = 1\n1039: \t`\n1040: \trows, err := s.db.Query(query, args...)\n",
"line": "1027-1039",
"column": "11",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/run_aggregates.go",
"code": "162: \tph := nextPlaceholder(dialect)\n163: \tquery := \"SELECT id FROM runs WHERE status = \" + ph()\n164: \targs := []interface{}{status}\n",
"line": "163",
"column": "11",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/run_aggregates.go",
"code": "132: \tph := nextPlaceholder(dialect)\n133: \tquery := \"SELECT \" + dayCol + \" AS day, \" + pipelineCol + \" AS pipeline_id, status, COUNT(*) AS n\" +\n134: \t\t\" FROM runs WHERE started_at IS NOT NULL AND started_at \u003e= \" + ph()\n135: \targs := []interface{}{sinceArg(dialect, since)}\n",
"line": "133-134",
"column": "11",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/postgres.go",
"code": "2983: \n2984: \tquery := `\n2985: \t\tSELECT DISTINCT ON (r.pipeline_id, np.node_id)\n2986: \t\t r.pipeline_id, np.node_id, np.profile, np.schema_snapshot, np.run_id, np.created_at\n2987: \t\tFROM node_profiles np\n2988: \t\tJOIN runs r ON r.id = np.run_id\n2989: \t\tWHERE r.pipeline_id IN (` + strings.Join(placeholders, \",\") + `)\n2990: \t\tORDER BY r.pipeline_id, np.node_id, np.created_at DESC\n2991: \t`\n2992: \trows, err := s.db.Query(query, args...)\n",
"line": "2984-2991",
"column": "11",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/postgres.go",
"code": "2932: \t}\n2933: \trows, err := s.db.Query(`\n2934: \t\tSELECT id, run_id, node_id, status, row_count, started_at, duration_ms, error, attempt, queue_ms\n2935: \t\tFROM (\n2936: \t\t\tSELECT id, run_id, node_id, status, row_count, started_at, duration_ms, error, attempt, queue_ms,\n2937: \t\t\t ROW_NUMBER() OVER (PARTITION BY run_id, node_id ORDER BY attempt DESC) AS rn\n2938: \t\t\tFROM node_runs WHERE run_id IN (`+strings.Join(placeholders, \",\")+`)\n2939: \t\t) latest WHERE rn = 1`, args...)\n2940: \tif err != nil {\n",
"line": "2933-2939",
"column": "26",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/postgres.go",
"code": "905: \n906: \tquery := `\n907: \t\tSELECT DISTINCT ON (pipeline_id)\n908: \t\t id, pipeline_id, status, started_at, finished_at, trace_id, error, params, pipeline_version, resumed_from_run_id, org_id, cancel_requested, trigger_type, data_interval_start, data_interval_end\n909: \t\tFROM runs\n910: \t\tWHERE pipeline_id IN (` + strings.Join(placeholders, \",\") + `)\n911: \t\tORDER BY pipeline_id, started_at DESC NULLS FIRST, id DESC\n912: \t`\n913: \trows, err := s.db.Query(query, args...)\n",
"line": "906-912",
"column": "11",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/alert_incidents.go",
"code": "373: \t_, err := db.Exec(\n374: \t\t`INSERT INTO alert_reads (alert_id, user_id, read_at)\n375: \t\t SELECT id, `+phAt(dialect, 1)+`, `+phAt(dialect, 2)+` FROM alerts\n376: \t\t WHERE org_id = `+phAt(dialect, 3)+` AND dismissed_at IS NULL\n377: \t\t ON CONFLICT(alert_id, user_id) DO UPDATE SET read_at = excluded.read_at`,\n378: \t\tuserID, alertTimeArg(dialect, at), orgID)\n",
"line": "374-377",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/alert_incidents.go",
"code": "356: \t_, err = db.Exec(\n357: \t\t`INSERT INTO alert_reads (alert_id, user_id, read_at) VALUES (`+\n358: \t\t\tphAt(dialect, 1)+`, `+phAt(dialect, 2)+`, `+phAt(dialect, 3)+`)`+\n359: \t\t\t` ON CONFLICT(alert_id, user_id) DO UPDATE SET read_at = excluded.read_at`,\n360: \t\talertID, userID, alertTimeArg(dialect, at))\n",
"line": "357-359",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/alert_incidents.go",
"code": "220: \trows, err := db.Query(\n221: \t\t`SELECT alert_id, read_at FROM alert_reads WHERE user_id = `+userMark+\n222: \t\t\t` AND alert_id IN (`+strings.Join(marks, \",\")+`)`, args...)\n223: \tif err != nil {\n",
"line": "221-222",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "89",
"url": "https://cwe.mitre.org/data/definitions/89.html"
},
"rule_id": "G202",
"details": "SQL string concatenation",
"file": "/src/store/alert_incidents.go",
"code": "136: \tph := nextPlaceholder(dialect)\n137: \tquery := `SELECT ` + alertIncidentColumns + ` FROM alerts WHERE org_id = ` + ph() + ` AND dismissed_at IS NULL`\n138: \targs := []interface{}{q.OrgID}\n",
"line": "137",
"column": "11",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/pkg/plugins/manifest.go",
"code": "287: \tpath := filepath.Join(dir, \"manifest.json\")\n288: \traw, err := os.ReadFile(path)\n289: \tif err != nil {\n",
"line": "288",
"column": "14",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/pkg/dbtmanifest/runresults.go",
"code": "217: func ParseRunResultsFile(path string) (*RunResults, error) {\n218: \tf, err := os.Open(path)\n219: \tif err != nil {\n",
"line": "218",
"column": "12",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/pkg/dbtmanifest/manifest.go",
"code": "230: func ParseFile(path string) (*Project, error) {\n231: \tf, err := os.Open(path)\n232: \tif err != nil {\n",
"line": "231",
"column": "12",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/engine/node_dbt.go",
"code": "221: \tvar out dbtRunResults\n222: \tdata, err := os.ReadFile(filepath.Join(projectDir, \"target\", \"run_results.json\"))\n223: \tif err != nil {\n",
"line": "222",
"column": "15",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/engine/ndjson_transfer.go",
"code": "212: func ReadColumnarBinary(path string) (*common.DataSet, error) {\n213: \tdata, err := os.ReadFile(path)\n214: \tif err != nil {\n",
"line": "213",
"column": "15",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/engine/ndjson_transfer.go",
"code": "164: \n165: \tf, err := os.Create(path)\n166: \tif err != nil {\n",
"line": "165",
"column": "12",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/engine/ndjson_transfer.go",
"code": "122: func ReadNDJSON(path string) (*common.DataSet, error) {\n123: \tdata, err := os.ReadFile(path)\n124: \tif err != nil {\n",
"line": "123",
"column": "15",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/engine/ndjson_transfer.go",
"code": "28: func WriteNDJSON(path string, ds *common.DataSet) error {\n29: \tf, err := os.Create(path)\n30: \tif err != nil {\n",
"line": "29",
"column": "12",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/engine/codenode.go",
"code": "398: func readCSVFile(path string) (*common.DataSet, error) {\n399: \tf, err := os.Open(path)\n400: \tif err != nil {\n",
"line": "399",
"column": "12",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/engine/codenode.go",
"code": "366: func writeCSVFile(ds *common.DataSet, path string) error {\n367: \tf, err := os.Create(path)\n368: \tif err != nil {\n",
"line": "367",
"column": "12",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/crypto/crypto.go",
"code": "102: \t// Priority 2: File-based key (development)\n103: \tif key, err := os.ReadFile(keyPath); err == nil {\n104: \t\tif len(key) \u003e= 32 {\n",
"line": "103",
"column": "17",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/cmd/testcmd.go",
"code": "27: \t\t// Load assertions from YAML file\n28: \t\tdata, err := os.ReadFile(assertionFile)\n29: \t\tif err != nil {\n",
"line": "28",
"column": "16",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/cmd/plugins.go",
"code": "255: \t\t}\n256: \t\tout, err := os.OpenFile(dstPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, info.Mode().Perm())\n257: \t\tif err != nil {\n",
"line": "256",
"column": "15",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/cmd/plugins.go",
"code": "251: \t\t}\n252: \t\tin, err := os.Open(srcPath)\n253: \t\tif err != nil {\n",
"line": "252",
"column": "14",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/cmd/dev.go",
"code": "163: func importYAMLFile(path, dbPath string) bool {\n164: \tdata, err := os.ReadFile(path)\n165: \tif err != nil {\n",
"line": "164",
"column": "15",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "22",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
"rule_id": "G304",
"details": "Potential file inclusion via variable",
"file": "/src/cmd/auth.go",
"code": "41: \t}\n42: \tdata, err := os.ReadFile(filepath.Join(dir, \"config.json\"))\n43: \tif err != nil {\n",
"line": "42",
"column": "15",
"nosec": false,
"suppressions": null,
"autofix": "Consider using os.Root to scope file access under a fixed root (Go \u003e=1.24). Prefer root.Open/root.Stat over os.Open/os.Stat to prevent directory traversal."
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "276",
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
"rule_id": "G301",
"details": "Expect directory permissions to be 0750 or less",
"file": "/src/pkg/plugins/manager.go",
"code": "498: func WriteManifest(dir string, m *Manifest) error {\n499: \tif err := os.MkdirAll(dir, 0o755); err != nil {\n500: \t\treturn err\n",
"line": "499",
"column": "12",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "276",
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
"rule_id": "G301",
"details": "Expect directory permissions to be 0750 or less",
"file": "/src/engine/node_handlers.go",
"code": "953: \tif dir := filepath.Dir(path); dir != \"\" {\n954: \t\tif err := os.MkdirAll(dir, 0o755); err != nil {\n955: \t\t\treturn nil, fmt.Errorf(\"create output directory: %w\", err)\n",
"line": "954",
"column": "13",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "276",
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
"rule_id": "G301",
"details": "Expect directory permissions to be 0750 or less",
"file": "/src/cmd/plugins.go",
"code": "231: func copyTree(src, dst string) error {\n232: \tif err := os.MkdirAll(dst, 0o755); err != nil {\n233: \t\treturn err\n",
"line": "232",
"column": "12",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "276",
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
"rule_id": "G301",
"details": "Expect directory permissions to be 0750 or less",
"file": "/src/cmd/plugins.go",
"code": "100: \t\tdir := plugins.DefaultDir()\n101: \t\tif err := os.MkdirAll(dir, 0o755); err != nil {\n102: \t\t\treturn fmt.Errorf(\"create plugin dir %s: %w\", dir, err)\n",
"line": "101",
"column": "13",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "276",
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
"rule_id": "G306",
"details": "Expect WriteFile permissions to be 0600 or less",
"file": "/src/pkg/plugins/manager.go",
"code": "505: \t}\n506: \treturn os.WriteFile(filepath.Join(dir, \"manifest.json\"), buf, 0o644)\n507: }\n",
"line": "506",
"column": "9",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "276",
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
"rule_id": "G306",
"details": "Expect WriteFile permissions to be 0600 or less",
"file": "/src/engine/node_handlers.go",
"code": "993: \n994: \tif err := os.WriteFile(path, content, 0o644); err != nil {\n995: \t\treturn nil, fmt.Errorf(\"write %s: %w\", path, err)\n",
"line": "994",
"column": "12",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "276",
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
"rule_id": "G306",
"details": "Expect WriteFile permissions to be 0600 or less",
"file": "/src/engine/ndjson_transfer.go",
"code": "161: \tif ds == nil || len(ds.Rows) == 0 {\n162: \t\treturn os.WriteFile(path, []byte{}, 0o644)\n163: \t}\n",
"line": "162",
"column": "10",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "276",
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
"rule_id": "G306",
"details": "Expect WriteFile permissions to be 0600 or less",
"file": "/src/cmd/pipeline.go",
"code": "69: \t\tif outFile != \"\" {\n70: \t\t\tif err := os.WriteFile(outFile, data, 0o644); err != nil {\n71: \t\t\t\treturn fmt.Errorf(\"write file: %w\", err)\n",
"line": "70",
"column": "14",
"nosec": false,
"suppressions": null
},
{
"severity": "MEDIUM",
"confidence": "HIGH",
"cwe": {
"id": "276",
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
"rule_id": "G306",
"details": "Expect WriteFile permissions to be 0600 or less",
"file": "/src/cmd/dev.go",
"code": "195: \ttmpFile := path + \".compiled.yaml\"\n196: \tif err := os.WriteFile(tmpFile, output, 0o644); err != nil {\n197: \t\tlog.Printf(\" write compiled yaml: %v\", err)\n",
"line": "196",
"column": "12",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G706",
"details": "Log injection via taint analysis",
"file": "/src/pkg/netguard/netguard.go",
"code": "134: \t\t\tif err != nil {\n135: \t\t\t\tlog.Printf(\"netguard: ignoring invalid CIDR %q in BROKOLI_OUTBOUND_ALLOW_CIDRS: %v\", raw, err)\n136: \t\t\t\tcontinue\n",
"line": "135",
"column": "15",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G706",
"details": "Log injection via taint analysis",
"file": "/src/engine/shared_blob_store.go",
"code": "56: \t}\n57: \tlog.Printf(\"Shared blob store: s3 bucket %q, for cross-pod staged task inputs\", bucket)\n58: \treturn st\n",
"line": "57",
"column": "12",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G706",
"details": "Log injection via taint analysis",
"file": "/src/engine/shared_blob_store.go",
"code": "52: \t\t// which one happened because this line is in the log above it.\n53: \t\tlog.Printf(\"shared blob store: bucket %q is configured but unusable, \"+\n54: \t\t\t\"reference-based task input will be refused: %v\", bucket, err)\n",
"line": "53",
"column": "13",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G706",
"details": "Log injection via taint analysis",
"file": "/src/cmd/serve.go",
"code": "854: \t\t}\n855: \t\tlog.Printf(\"WARNING: ignoring BROKOLI_WORKER_DRAIN_TIMEOUT=%q: expected a duration like 5m or a number of seconds\", v)\n856: \t}\n",
"line": "855",
"column": "13",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G706",
"details": "Log injection via taint analysis",
"file": "/src/api/middleware.go",
"code": "22: \t\tpath := strings.ReplaceAll(strings.ReplaceAll(r.URL.Path, \"\\n\", \"\"), \"\\r\", \"\")\n23: \t\tlog.Printf(\"%s %s %d %s\", r.Method, path, wrapped.status, time.Since(start))\n24: \t})\n",
"line": "23",
"column": "13",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G706",
"details": "Log injection via taint analysis",
"file": "/src/api/handlers_run.go",
"code": "278: \t} else {\n279: \t\tlog.Printf(\"run %s: could not read who started it: %v\", run.ID, err)\n280: \t}\n",
"line": "279",
"column": "13",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G706",
"details": "Log injection via taint analysis",
"file": "/src/api/handlers_misc.go",
"code": "142: \t\tif !engine.ValidateWebhookToken(token, p.WebhookToken) {\n143: \t\t\tlog.Printf(\"webhook %q: invalid webhook token\", id)\n144: \t\t\tDenyOrgAccess(w)\n",
"line": "143",
"column": "14",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G706",
"details": "Log injection via taint analysis",
"file": "/src/api/handlers_misc.go",
"code": "137: \t\tif p.WebhookToken == \"\" {\n138: \t\t\tlog.Printf(\"webhook %q: webhook not configured\", id)\n139: \t\t\tDenyOrgAccess(w)\n",
"line": "138",
"column": "14",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": null,
"rule_id": "G706",
"details": "Log injection via taint analysis",
"file": "/src/api/handlers_misc.go",
"code": "132: \t\t\t// tell missing pipelines apart from unconfigured or bad-token ones.\n133: \t\t\tlog.Printf(\"webhook %q: pipeline not found\", id)\n134: \t\t\tDenyOrgAccess(w)\n",
"line": "133",
"column": "14",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "3405: \t\tvar exists int\n3406: \t\ts.db.QueryRow(\"SELECT COUNT(*) FROM roles WHERE id=?\", id).Scan(\u0026exists)\n3407: \t\tif exists \u003e 0 {\n",
"line": "3406",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "3388: \t\tvar exists int\n3389: \t\ts.db.QueryRow(\"SELECT COUNT(*) FROM roles WHERE id=?\", r.ID).Scan(\u0026exists)\n3390: \t\tif exists \u003e 0 {\n",
"line": "3389",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "3366: \t\tr.IsSystem = isSystem != 0\n3367: \t\tjson.Unmarshal([]byte(permsJSON), \u0026r.Permissions)\n3368: \t\troles = append(roles, r)\n",
"line": "3367",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2726: \t\tvar expiresAt, createdAt, lastUsed string\n2727: \t\trows.Scan(\u0026t.ID, \u0026t.Name, \u0026t.WorkspaceID, \u0026t.UserID, \u0026t.Role, \u0026expiresAt, \u0026createdAt, \u0026lastUsed)\n2728: \t\tt.ExpiresAt, _ = time.Parse(timeFormat, expiresAt)\n",
"line": "2727",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2677: \t\tvar createdAt, updatedAt string\n2678: \t\trows.Scan(\u0026w.ID, \u0026w.Name, \u0026w.Slug, \u0026w.Description, \u0026createdAt, \u0026updatedAt)\n2679: \t\tw.CreatedAt, _ = time.Parse(timeFormat, createdAt)\n",
"line": "2678",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2654: \t\tvar joinedAt string\n2655: \t\trows.Scan(\u0026m.WorkspaceID, \u0026m.UserID, \u0026m.Username, \u0026m.Role, \u0026joinedAt)\n2656: \t\tm.JoinedAt, _ = time.Parse(timeFormat, joinedAt)\n",
"line": "2655",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2605: \t\tvar createdAt, updatedAt string\n2606: \t\trows.Scan(\u0026w.ID, \u0026w.Name, \u0026w.Slug, \u0026w.Description, \u0026createdAt, \u0026updatedAt)\n2607: \t\tw.CreatedAt, _ = time.Parse(timeFormat, createdAt)\n",
"line": "2606",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2326: \tif depRulesJSON != \"\" \u0026\u0026 depRulesJSON != \"null\" {\n2327: \t\tjson.Unmarshal([]byte(depRulesJSON), \u0026p.DependencyRules)\n2328: \t}\n",
"line": "2327",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2323: \tif depsJSON != \"\" \u0026\u0026 depsJSON != \"null\" {\n2324: \t\tjson.Unmarshal([]byte(depsJSON), \u0026p.DependsOn)\n2325: \t}\n",
"line": "2324",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2320: \tif tagsJSON != \"\" \u0026\u0026 tagsJSON != \"null\" {\n2321: \t\tjson.Unmarshal([]byte(tagsJSON), \u0026p.Tags)\n2322: \t}\n",
"line": "2321",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2317: \tif paramsJSON != \"\" \u0026\u0026 paramsJSON != \"null\" {\n2318: \t\tjson.Unmarshal([]byte(paramsJSON), \u0026p.Params)\n2319: \t}\n",
"line": "2318",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2291: \ts.db.QueryRow(\"PRAGMA page_count\").Scan(\u0026pageCount)\n2292: \ts.db.QueryRow(\"PRAGMA page_size\").Scan(\u0026pageSize)\n2293: \treturn pageCount * pageSize, nil\n",
"line": "2292",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2290: \tvar pageCount, pageSize int64\n2291: \ts.db.QueryRow(\"PRAGMA page_count\").Scan(\u0026pageCount)\n2292: \ts.db.QueryRow(\"PRAGMA page_size\").Scan(\u0026pageSize)\n",
"line": "2291",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2241: \t// VACUUM to reclaim space\n2242: \ts.db.Exec(\"VACUUM\")\n2243: \treturn result.RowsAffected()\n",
"line": "2242",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "2048: \t\tvar maxVer sql.NullInt64\n2049: \t\ts.db.QueryRow(`SELECT MAX(version) FROM pipeline_versions WHERE pipeline_id = ?`, pipelineID).Scan(\u0026maxVer)\n2050: \t\tnextVer := 1\n",
"line": "2049",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "990: \t\tif depRulesJSON != \"\" \u0026\u0026 depRulesJSON != \"null\" {\n991: \t\t\tjson.Unmarshal([]byte(depRulesJSON), \u0026s.DependencyRules)\n992: \t\t}\n",
"line": "991",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "987: \t\tif depsJSON != \"\" \u0026\u0026 depsJSON != \"null\" {\n988: \t\t\tjson.Unmarshal([]byte(depsJSON), \u0026s.DependsOn)\n989: \t\t}\n",
"line": "988",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "910: \tvar total int\n911: \ts.db.QueryRow(`SELECT COUNT(*) FROM variables WHERE workspace_id = ?`, wsID).Scan(\u0026total)\n912: \tvars, err := s.ListVariablesByWorkspace(wsID)\n",
"line": "911",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "893: \tvar total int\n894: \ts.db.QueryRow(`SELECT COUNT(*) FROM connections WHERE workspace_id = ?`, wsID).Scan(\u0026total)\n895: \tconns, err := s.ListConnectionsByWorkspace(wsID)\n",
"line": "894",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "839: \tvar total int\n840: \ts.db.QueryRow(`SELECT COUNT(*) FROM pipelines WHERE org_id = ?`, orgID).Scan(\u0026total)\n841: \trows, err := s.db.Query(\n",
"line": "840",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "653: \tif err := fn(tx); err != nil {\n654: \t\ttx.Rollback()\n655: \t\treturn err\n",
"line": "654",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "467: \t// not be silently reverted on every subsequent startup.\n468: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS pipeline_templates (\n469: \t\tid TEXT PRIMARY KEY,\n470: \t\tname TEXT NOT NULL,\n471: \t\tdescription TEXT NOT NULL DEFAULT '',\n472: \t\ticon TEXT NOT NULL DEFAULT '',\n473: \t\tnodes TEXT NOT NULL DEFAULT '[]',\n474: \t\tedges TEXT NOT NULL DEFAULT '[]',\n475: \t\tcreated_at TEXT NOT NULL,\n476: \t\tupdated_at TEXT NOT NULL)`)\n477: \tif err := s.seedPipelineTemplates(); err != nil {\n",
"line": "468-476",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "414: \t\tdismissed_at TEXT)`)\n415: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_alerts_org ON alerts(org_id, created_at DESC)`)\n416: \t// Incident ownership and per-person read state (brokoli-ee#242),\n",
"line": "415",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "401: \t// indexed because every query is org-scoped.\n402: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS alerts (\n403: \t\tid TEXT PRIMARY KEY,\n404: \t\torg_id TEXT NOT NULL DEFAULT '',\n405: \t\tkind TEXT NOT NULL,\n406: \t\tseverity TEXT NOT NULL DEFAULT 'info',\n407: \t\ttitle TEXT NOT NULL,\n408: \t\tbody TEXT NOT NULL DEFAULT '',\n409: \t\tpipeline_id TEXT NOT NULL DEFAULT '',\n410: \t\tpipeline_name TEXT NOT NULL DEFAULT '',\n411: \t\trun_id TEXT NOT NULL DEFAULT '',\n412: \t\tcreated_at TEXT NOT NULL,\n413: \t\tread_at TEXT,\n414: \t\tdismissed_at TEXT)`)\n415: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_alerts_org ON alerts(org_id, created_at DESC)`)\n",
"line": "402-414",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "395: \t// with a guess.\n396: \ts.db.Exec(`UPDATE runs SET org_id = COALESCE((SELECT p.org_id FROM pipelines p WHERE p.id = runs.pipeline_id), org_id) WHERE org_id = 'default'`)\n397: \n",
"line": "396",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "379: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN org_id TEXT NOT NULL DEFAULT 'default'`)\n380: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_org ON runs(org_id)`)\n381: \n",
"line": "380",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "378: \t// work, not something that issue's own scope introduced).\n379: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN org_id TEXT NOT NULL DEFAULT 'default'`)\n380: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_org ON runs(org_id)`)\n",
"line": "379",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "337: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n338: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_expansion_instances_run_node ON expansion_instances(run_id, node_id, node_attempt)`)\n339: \n",
"line": "338",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "324: \t// attempt) keying.\n325: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS expansion_instances (\n326: \t\tid TEXT PRIMARY KEY,\n327: \t\trun_id TEXT NOT NULL,\n328: \t\tnode_id TEXT NOT NULL,\n329: \t\tnode_attempt INTEGER NOT NULL DEFAULT 0,\n330: \t\tinstance_index INTEGER NOT NULL,\n331: \t\tinstance_key TEXT NOT NULL DEFAULT '',\n332: \t\tstatus TEXT NOT NULL DEFAULT 'running',\n333: \t\trow_count INTEGER NOT NULL DEFAULT 0,\n334: \t\tstarted_at TEXT,\n335: \t\tduration_ms INTEGER NOT NULL DEFAULT 0,\n336: \t\terror TEXT NOT NULL DEFAULT '',\n337: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n338: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_expansion_instances_run_node ON expansion_instances(run_id, node_id, node_attempt)`)\n",
"line": "325-337",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "313: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS uq_runs_scheduled_interval ON runs(pipeline_id, data_interval_start) WHERE trigger_type = 'scheduled' AND data_interval_start IS NOT NULL`)\n314: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_resumed_from ON runs(resumed_from_run_id) WHERE resumed_from_run_id != ''`)\n315: \n",
"line": "314",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "312: \n313: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS uq_runs_scheduled_interval ON runs(pipeline_id, data_interval_start) WHERE trigger_type = 'scheduled' AND data_interval_start IS NOT NULL`)\n314: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_resumed_from ON runs(resumed_from_run_id) WHERE resumed_from_run_id != ''`)\n",
"line": "313",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "306: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN data_interval_start TEXT`)\n307: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN data_interval_end TEXT`)\n308: \t// #241: who started a run, in its own table. Created through one\n",
"line": "307",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "305: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN trigger_type TEXT NOT NULL DEFAULT ''`)\n306: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN data_interval_start TEXT`)\n307: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN data_interval_end TEXT`)\n",
"line": "306",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "304: \t// interval is a deliberate new run.\n305: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN trigger_type TEXT NOT NULL DEFAULT ''`)\n306: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN data_interval_start TEXT`)\n",
"line": "305",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "297: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN pipeline_version INTEGER NOT NULL DEFAULT 0`)\n298: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN resumed_from_run_id TEXT NOT NULL DEFAULT ''`)\n299: \t// ADR-028: the data interval a scheduled run covers, and what created\n",
"line": "298",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "296: \t// practice even though they're technically updatable columns.\n297: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN pipeline_version INTEGER NOT NULL DEFAULT 0`)\n298: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN resumed_from_run_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "297",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "287: \t// consistent with this migration style, rather than blocking startup.\n288: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_pipeline_versions_unique ON pipeline_versions(pipeline_id, version)`)\n289: \n",
"line": "288",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "258: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_execution_attempts_lease ON execution_attempts(status, lease_expires_at)`)\n259: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_execution_attempts_idempotency ON execution_attempts(idempotency_key)`)\n260: \n",
"line": "259",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "257: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n258: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_execution_attempts_lease ON execution_attempts(status, lease_expires_at)`)\n259: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_execution_attempts_idempotency ON execution_attempts(idempotency_key)`)\n",
"line": "258",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "242: \t// than a tracked migration file.\n243: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS execution_attempts (\n244: \t\trun_id TEXT NOT NULL,\n245: \t\tnode_id TEXT NOT NULL DEFAULT '',\n246: \t\tinstance_key TEXT NOT NULL DEFAULT '',\n247: \t\tattempt INTEGER NOT NULL DEFAULT 0,\n248: \t\tstatus TEXT NOT NULL DEFAULT 'queued',\n249: \t\tclaimed_by TEXT NOT NULL DEFAULT '',\n250: \t\tlease_expires_at TEXT,\n251: \t\tfencing_generation INTEGER NOT NULL DEFAULT 0,\n252: \t\tidempotency_key TEXT NOT NULL DEFAULT '',\n253: \t\terror TEXT NOT NULL DEFAULT '',\n254: \t\tcreated_at TEXT NOT NULL,\n255: \t\tupdated_at TEXT NOT NULL,\n256: \t\tPRIMARY KEY (run_id, node_id, instance_key, attempt),\n257: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n258: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_execution_attempts_lease ON execution_attempts(status, lease_expires_at)`)\n",
"line": "243-257",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "232: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_run_events_run ON run_events(run_id)`)\n233: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_run_events_run_node ON run_events(run_id, node_id)`)\n234: \n",
"line": "233",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "231: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n232: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_run_events_run ON run_events(run_id)`)\n233: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_run_events_run_node ON run_events(run_id, node_id)`)\n",
"line": "232",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "221: \t// function works.\n222: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS run_events (\n223: \t\tid INTEGER PRIMARY KEY AUTOINCREMENT,\n224: \t\trun_id TEXT NOT NULL,\n225: \t\tnode_id TEXT,\n226: \t\tattempt INTEGER,\n227: \t\tevent_type TEXT NOT NULL,\n228: \t\tpayload TEXT NOT NULL DEFAULT '{}',\n229: \t\tcreated_at TEXT NOT NULL,\n230: \t\tschema_version INTEGER NOT NULL DEFAULT 1,\n231: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n232: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_run_events_run ON run_events(run_id)`)\n",
"line": "222-231",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "213: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN metadata TEXT NOT NULL DEFAULT '{}'`)\n214: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_runs_node_pipeline ON node_runs(node_id, run_id)`)\n215: \n",
"line": "214",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "212: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN attempt INTEGER NOT NULL DEFAULT 0`)\n213: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN metadata TEXT NOT NULL DEFAULT '{}'`)\n214: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_runs_node_pipeline ON node_runs(node_id, run_id)`)\n",
"line": "213",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "211: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN span_id TEXT NOT NULL DEFAULT ''`)\n212: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN attempt INTEGER NOT NULL DEFAULT 0`)\n213: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN metadata TEXT NOT NULL DEFAULT '{}'`)\n",
"line": "212",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "210: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN trace_id TEXT NOT NULL DEFAULT ''`)\n211: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN span_id TEXT NOT NULL DEFAULT ''`)\n212: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN attempt INTEGER NOT NULL DEFAULT 0`)\n",
"line": "211",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "209: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN span_id TEXT NOT NULL DEFAULT ''`)\n210: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN trace_id TEXT NOT NULL DEFAULT ''`)\n211: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN span_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "210",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "208: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN trace_id TEXT NOT NULL DEFAULT ''`)\n209: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN span_id TEXT NOT NULL DEFAULT ''`)\n210: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN trace_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "209",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "207: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN rows_per_sec REAL NOT NULL DEFAULT 0`)\n208: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN trace_id TEXT NOT NULL DEFAULT ''`)\n209: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN span_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "208",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "206: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN queue_ms INTEGER NOT NULL DEFAULT 0`)\n207: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN rows_per_sec REAL NOT NULL DEFAULT 0`)\n208: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN trace_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "207",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "205: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN ready_at TEXT`)\n206: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN queue_ms INTEGER NOT NULL DEFAULT 0`)\n207: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN rows_per_sec REAL NOT NULL DEFAULT 0`)\n",
"line": "206",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "204: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN attempt INTEGER NOT NULL DEFAULT 0`)\n205: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN ready_at TEXT`)\n206: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN queue_ms INTEGER NOT NULL DEFAULT 0`)\n",
"line": "205",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "203: \t}\n204: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN attempt INTEGER NOT NULL DEFAULT 0`)\n205: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN ready_at TEXT`)\n",
"line": "204",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "197: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN error TEXT NOT NULL DEFAULT ''`)\n198: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN params TEXT NOT NULL DEFAULT '{}'`)\n199: \t// ADR-032 rollout step 4 (#439): the resolved, typed run-parameter\n",
"line": "198",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "196: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN trace_id TEXT NOT NULL DEFAULT ''`)\n197: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN error TEXT NOT NULL DEFAULT ''`)\n198: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN params TEXT NOT NULL DEFAULT '{}'`)\n",
"line": "197",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "195: \t// Tracing \u0026 observability columns\n196: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN trace_id TEXT NOT NULL DEFAULT ''`)\n197: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN error TEXT NOT NULL DEFAULT ''`)\n",
"line": "196",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "192: \ts.db.Exec(`UPDATE connections SET password_ref = 'encrypted://' || password_enc WHERE password_enc != '' AND password_ref = ''`)\n193: \ts.db.Exec(`UPDATE connections SET extra_ref = 'encrypted://' || extra_enc WHERE extra_enc != '' AND extra_ref = ''`)\n194: \n",
"line": "193",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "191: \t// with encrypted:// prefix so the resolver chain handles them.\n192: \ts.db.Exec(`UPDATE connections SET password_ref = 'encrypted://' || password_enc WHERE password_enc != '' AND password_ref = ''`)\n193: \ts.db.Exec(`UPDATE connections SET extra_ref = 'encrypted://' || extra_enc WHERE extra_enc != '' AND extra_ref = ''`)\n",
"line": "192",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "188: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN extra_ref TEXT NOT NULL DEFAULT ''`)\n189: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN max_concurrent INTEGER NOT NULL DEFAULT 0`)\n190: \t// Migrate legacy encrypted values: copy password_enc → password_ref\n",
"line": "189",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "187: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN password_ref TEXT NOT NULL DEFAULT ''`)\n188: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN extra_ref TEXT NOT NULL DEFAULT ''`)\n189: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN max_concurrent INTEGER NOT NULL DEFAULT 0`)\n",
"line": "188",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "186: \t// instead of bare encrypted blobs. See pkg/secrets for resolvers.\n187: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN password_ref TEXT NOT NULL DEFAULT ''`)\n188: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN extra_ref TEXT NOT NULL DEFAULT ''`)\n",
"line": "187",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "182: \t\tFOREIGN KEY (pipeline_id) REFERENCES pipelines(id) ON DELETE CASCADE)`)\n183: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_dlq_pipeline ON dead_letter_queue(pipeline_id, resolved, created_at DESC)`)\n184: \n",
"line": "183",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "170: \t// Dead letter queue\n171: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS dead_letter_queue (\n172: \t\tid TEXT PRIMARY KEY,\n173: \t\tpipeline_id TEXT NOT NULL,\n174: \t\trun_id TEXT NOT NULL,\n175: \t\terror TEXT NOT NULL,\n176: \t\tnode_id TEXT NOT NULL DEFAULT '',\n177: \t\tnode_name TEXT NOT NULL DEFAULT '',\n178: \t\tpayload TEXT NOT NULL DEFAULT '{}',\n179: \t\tcreated_at TEXT NOT NULL,\n180: \t\tresolved INTEGER NOT NULL DEFAULT 0,\n181: \t\tresolved_at TEXT,\n182: \t\tFOREIGN KEY (pipeline_id) REFERENCES pipelines(id) ON DELETE CASCADE)`)\n183: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_dlq_pipeline ON dead_letter_queue(pipeline_id, resolved, created_at DESC)`)\n",
"line": "171-182",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "164: \t\t\tpermsJSON, _ := json.Marshal(role.Permissions)\n165: \t\t\ts.db.Exec(\"INSERT INTO roles (id, name, description, permissions, is_system, created_at) VALUES (?,?,?,?,?,?)\",\n166: \t\t\t\trole.ID, role.Name, role.Description, string(permsJSON), boolToInt(role.IsSystem), time.Now().UTC().Format(timeFormat))\n167: \t\t}\n",
"line": "165-166",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "160: \tvar roleCount int\n161: \ts.db.QueryRow(\"SELECT COUNT(*) FROM roles\").Scan(\u0026roleCount)\n162: \tif roleCount == 0 {\n",
"line": "161",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "153: \t// Roles table\n154: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS roles (\n155: \t\tid TEXT PRIMARY KEY, name TEXT NOT NULL UNIQUE, description TEXT NOT NULL DEFAULT '',\n156: \t\tpermissions TEXT NOT NULL DEFAULT '[]', is_system INTEGER NOT NULL DEFAULT 0,\n157: \t\tcreated_at TEXT NOT NULL)`)\n158: \n",
"line": "154-157",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "150: \t\tattempted_at TEXT NOT NULL)`)\n151: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_login_attempts ON login_attempts(username, attempted_at DESC)`)\n152: \n",
"line": "151",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "144: \t// Login attempts tracking (account lockout)\n145: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS login_attempts (\n146: \t\tid INTEGER PRIMARY KEY AUTOINCREMENT,\n147: \t\tusername TEXT NOT NULL,\n148: \t\tip TEXT NOT NULL DEFAULT '',\n149: \t\tsuccess INTEGER NOT NULL DEFAULT 0,\n150: \t\tattempted_at TEXT NOT NULL)`)\n151: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_login_attempts ON login_attempts(username, attempted_at DESC)`)\n",
"line": "145-150",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "141: \t// Settings key-value store\n142: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS settings (key TEXT PRIMARY KEY, value TEXT NOT NULL DEFAULT '')`)\n143: \n",
"line": "142",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "138: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_pipeline_id ON runs(pipeline_id, id DESC)`)\n139: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_runs_run_status ON node_runs(run_id, status)`)\n140: \n",
"line": "139",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "137: \t// pipeline_id and ranges over id. Without this, every page is a scan.\n138: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_pipeline_id ON runs(pipeline_id, id DESC)`)\n139: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_runs_run_status ON node_runs(run_id, status)`)\n",
"line": "138",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "133: \t}\n134: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_pipeline_status ON runs(pipeline_id, status, started_at DESC)`)\n135: \t// Backs the keyset walk in ListRunsByPipelineCursor. The status index\n",
"line": "134",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "129: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_connections_workspace ON connections(workspace_id)`)\n130: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_variables_workspace ON variables(workspace_id)`)\n131: \tif err := s.scopeVariablesToWorkspace(); err != nil {\n",
"line": "130",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "128: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_pipelines_workspace ON pipelines(workspace_id)`)\n129: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_connections_workspace ON connections(workspace_id)`)\n130: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_variables_workspace ON variables(workspace_id)`)\n",
"line": "129",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "127: \t// Performance indexes (safe to re-run)\n128: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_pipelines_workspace ON pipelines(workspace_id)`)\n129: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_connections_workspace ON connections(workspace_id)`)\n",
"line": "128",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "124: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n125: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_profiles ON node_profiles(run_id)`)\n126: \n",
"line": "125",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "118: \t// Node profiles table\n119: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS node_profiles (\n120: \t\trun_id TEXT NOT NULL, node_id TEXT NOT NULL,\n121: \t\tprofile TEXT NOT NULL DEFAULT '{}', schema_snapshot TEXT NOT NULL DEFAULT '{}',\n122: \t\tdrift_alerts TEXT NOT NULL DEFAULT '[]', created_at TEXT NOT NULL,\n123: \t\tPRIMARY KEY (run_id, node_id),\n124: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n125: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_profiles ON node_profiles(run_id)`)\n",
"line": "119-124",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "115: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'`)\n116: \ts.db.Exec(`ALTER TABLE variables ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'`)\n117: \n",
"line": "116",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "114: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_pipeline_pid ON pipelines(pipeline_id) WHERE pipeline_id != ''`)\n115: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'`)\n116: \ts.db.Exec(`ALTER TABLE variables ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'`)\n",
"line": "115",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "113: \t}\n114: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_pipeline_pid ON pipelines(pipeline_id) WHERE pipeline_id != ''`)\n115: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'`)\n",
"line": "114",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "98: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN source TEXT NOT NULL DEFAULT 'ui'`)\n99: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN org_id TEXT NOT NULL DEFAULT ''`)\n100: \tif _, err := s.db.Exec(`ALTER TABLE pipelines ADD COLUMN ir_version TEXT NOT NULL DEFAULT ''`); err != nil \u0026\u0026 !strings.Contains(err.Error(), \"duplicate column name\") {\n",
"line": "99",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "97: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN pipeline_id TEXT NOT NULL DEFAULT ''`)\n98: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN source TEXT NOT NULL DEFAULT 'ui'`)\n99: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN org_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "98",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "96: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN webhook_token TEXT NOT NULL DEFAULT ''`)\n97: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN pipeline_id TEXT NOT NULL DEFAULT ''`)\n98: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN source TEXT NOT NULL DEFAULT 'ui'`)\n",
"line": "97",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "95: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN dependency_rules TEXT NOT NULL DEFAULT '[]'`)\n96: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN webhook_token TEXT NOT NULL DEFAULT ''`)\n97: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN pipeline_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "96",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "94: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN depends_on TEXT NOT NULL DEFAULT '[]'`)\n95: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN dependency_rules TEXT NOT NULL DEFAULT '[]'`)\n96: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN webhook_token TEXT NOT NULL DEFAULT ''`)\n",
"line": "95",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "93: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN sla_timezone TEXT NOT NULL DEFAULT ''`)\n94: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN depends_on TEXT NOT NULL DEFAULT '[]'`)\n95: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN dependency_rules TEXT NOT NULL DEFAULT '[]'`)\n",
"line": "94",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "92: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN sla_deadline TEXT NOT NULL DEFAULT ''`)\n93: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN sla_timezone TEXT NOT NULL DEFAULT ''`)\n94: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN depends_on TEXT NOT NULL DEFAULT '[]'`)\n",
"line": "93",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "91: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_parked_waits_due ON parked_waits(next_poll_at)`)\n92: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN sla_deadline TEXT NOT NULL DEFAULT ''`)\n93: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN sla_timezone TEXT NOT NULL DEFAULT ''`)\n",
"line": "92",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "90: \t)`)\n91: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_parked_waits_due ON parked_waits(next_poll_at)`)\n92: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN sla_deadline TEXT NOT NULL DEFAULT ''`)\n",
"line": "91",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "80: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN draft INTEGER NOT NULL DEFAULT 0`)\n81: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS parked_waits (\n82: \t\trun_id TEXT PRIMARY KEY,\n83: \t\tpipeline_id TEXT NOT NULL,\n84: \t\tnode_id TEXT NOT NULL,\n85: \t\tcondition TEXT NOT NULL,\n86: \t\tpoll_interval_ms INTEGER NOT NULL,\n87: \t\tnext_poll_at TEXT NOT NULL,\n88: \t\texpires_at TEXT NOT NULL,\n89: \t\tcreated_at TEXT NOT NULL\n90: \t)`)\n91: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_parked_waits_due ON parked_waits(next_poll_at)`)\n",
"line": "81-90",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "79: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN catchup INTEGER NOT NULL DEFAULT 0`)\n80: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN draft INTEGER NOT NULL DEFAULT 0`)\n81: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS parked_waits (\n",
"line": "80",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "78: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN schedule_timezone TEXT NOT NULL DEFAULT ''`)\n79: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN catchup INTEGER NOT NULL DEFAULT 0`)\n80: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN draft INTEGER NOT NULL DEFAULT 0`)\n",
"line": "79",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "77: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'`)\n78: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN schedule_timezone TEXT NOT NULL DEFAULT ''`)\n79: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN catchup INTEGER NOT NULL DEFAULT 0`)\n",
"line": "78",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "76: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN tags TEXT NOT NULL DEFAULT '[]'`)\n77: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'`)\n78: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN schedule_timezone TEXT NOT NULL DEFAULT ''`)\n",
"line": "77",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "75: \t// Schema additions (safe to re-run, ignores \"already exists\" errors)\n76: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN tags TEXT NOT NULL DEFAULT '[]'`)\n77: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'`)\n",
"line": "76",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/sqlite.go",
"code": "56: \tif err := s.migrate(); err != nil {\n57: \t\tdb.Close()\n58: \t\treturn nil, fmt.Errorf(\"run migrations: %w\", err)\n",
"line": "57",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "3109: \t\tvar exists int\n3110: \t\ts.db.QueryRow(\"SELECT COUNT(*) FROM roles WHERE id=$1\", id).Scan(\u0026exists)\n3111: \t\tif exists \u003e 0 {\n",
"line": "3110",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "3092: \t\tvar exists int\n3093: \t\ts.db.QueryRow(\"SELECT COUNT(*) FROM roles WHERE id=$1\", r.ID).Scan(\u0026exists)\n3094: \t\tif exists \u003e 0 {\n",
"line": "3093",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "3071: \t\t}\n3072: \t\tjson.Unmarshal([]byte(permsJSON), \u0026r.Permissions)\n3073: \t\troles = append(roles, r)\n",
"line": "3072",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "2835: \t\tvar v models.Variable\n2836: \t\trows.Scan(\u0026v.Key, \u0026v.Value, \u0026v.Type, \u0026v.Description, \u0026v.CreatedAt, \u0026v.UpdatedAt)\n2837: \t\tvars = append(vars, v)\n",
"line": "2836",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "2824: \tvar total int\n2825: \ts.db.QueryRow(`SELECT COUNT(*) FROM variables WHERE workspace_id = $1`, workspaceID).Scan(\u0026total)\n2826: \trows, err := s.db.Query(\n",
"line": "2825",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "2816: \t\tvar c models.Connection\n2817: \t\trows.Scan(\u0026c.ID, \u0026c.ConnID, \u0026c.Type, \u0026c.Description, \u0026c.Host, \u0026c.Port, \u0026c.Schema, \u0026c.Login, \u0026c.Password, \u0026c.Extra, \u0026c.PasswordRef, \u0026c.ExtraRef, \u0026c.CreatedAt, \u0026c.UpdatedAt, \u0026c.MaxConcurrent)\n2818: \t\tconns = append(conns, c)\n",
"line": "2817",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "2804: \tvar total int\n2805: \ts.db.QueryRow(`SELECT COUNT(*) FROM connections WHERE workspace_id = $1`, workspaceID).Scan(\u0026total)\n2806: \trows, err := s.db.Query(\n",
"line": "2805",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "2750: \tvar total int\n2751: \ts.db.QueryRow(`SELECT COUNT(*) FROM pipelines WHERE org_id = $1`, orgID).Scan(\u0026total)\n2752: \trows, err := s.db.Query(\n",
"line": "2751",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "2698: \t\tvar t models.APIToken\n2699: \t\trows.Scan(\u0026t.ID, \u0026t.Name, \u0026t.WorkspaceID, \u0026t.UserID, \u0026t.Role, \u0026t.ExpiresAt, \u0026t.CreatedAt)\n2700: \t\tts = append(ts, t)\n",
"line": "2699",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "2673: \t\tvar w models.Workspace\n2674: \t\trows.Scan(\u0026w.ID, \u0026w.Name, \u0026w.Slug, \u0026w.Description, \u0026w.CreatedAt, \u0026w.UpdatedAt)\n2675: \t\tws = append(ws, w)\n",
"line": "2674",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "2659: \t\tvar m models.WorkspaceMember\n2660: \t\trows.Scan(\u0026m.WorkspaceID, \u0026m.UserID, \u0026m.Username, \u0026m.Role, \u0026m.JoinedAt)\n2661: \t\tms = append(ms, m)\n",
"line": "2660",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "2632: \t\tvar w models.Workspace\n2633: \t\trows.Scan(\u0026w.ID, \u0026w.Name, \u0026w.Slug, \u0026w.Description, \u0026w.CreatedAt, \u0026w.UpdatedAt)\n2634: \t\tws = append(ws, w)\n",
"line": "2633",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "1880: \t\tvar maxVer sql.NullInt64\n1881: \t\ts.db.QueryRow(`SELECT MAX(version) FROM pipeline_versions WHERE pipeline_id = $1`, pipelineID).Scan(\u0026maxVer)\n1882: \t\tnextVer := 1\n",
"line": "1881",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "1865: \tjson.Unmarshal(colJSON, \u0026columns)\n1866: \tjson.Unmarshal(rowJSON, \u0026rows)\n1867: \treturn columns, rows, nil\n",
"line": "1866",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "1864: \tvar rows []common.DataRow\n1865: \tjson.Unmarshal(colJSON, \u0026columns)\n1866: \tjson.Unmarshal(rowJSON, \u0026rows)\n",
"line": "1865",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "1831: \t\tif metadataStr != \"\" \u0026\u0026 metadataStr != \"{}\" {\n1832: \t\t\tjson.Unmarshal([]byte(metadataStr), \u0026entry.Metadata)\n1833: \t\t}\n",
"line": "1832",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "870: \t\tif len(depRulesJSON) \u003e 0 {\n871: \t\t\tjson.Unmarshal(depRulesJSON, \u0026summary.DependencyRules)\n872: \t\t}\n",
"line": "871",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "867: \t\tif len(depsJSON) \u003e 0 {\n868: \t\t\tjson.Unmarshal(depsJSON, \u0026summary.DependsOn)\n869: \t\t}\n",
"line": "868",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "766: \tjson.Unmarshal(depsJSON, \u0026p.DependsOn)\n767: \tjson.Unmarshal(depRulesJSON, \u0026p.DependencyRules)\n768: \tif len(hooksJSON) \u003e 0 \u0026\u0026 string(hooksJSON) != \"null\" \u0026\u0026 string(hooksJSON) != \"{}\" {\n",
"line": "767",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "765: \tjson.Unmarshal(tagsJSON, \u0026p.Tags)\n766: \tjson.Unmarshal(depsJSON, \u0026p.DependsOn)\n767: \tjson.Unmarshal(depRulesJSON, \u0026p.DependencyRules)\n",
"line": "766",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "764: \tjson.Unmarshal(paramsJSON, \u0026p.Params)\n765: \tjson.Unmarshal(tagsJSON, \u0026p.Tags)\n766: \tjson.Unmarshal(depsJSON, \u0026p.DependsOn)\n",
"line": "765",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "763: \tjson.Unmarshal(edgesJSON, \u0026p.Edges)\n764: \tjson.Unmarshal(paramsJSON, \u0026p.Params)\n765: \tjson.Unmarshal(tagsJSON, \u0026p.Tags)\n",
"line": "764",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "762: \tjson.Unmarshal(nodesJSON, \u0026p.Nodes)\n763: \tjson.Unmarshal(edgesJSON, \u0026p.Edges)\n764: \tjson.Unmarshal(paramsJSON, \u0026p.Params)\n",
"line": "763",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "761: \t}\n762: \tjson.Unmarshal(nodesJSON, \u0026p.Nodes)\n763: \tjson.Unmarshal(edgesJSON, \u0026p.Edges)\n",
"line": "762",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "626: \tif err := fn(tx); err != nil {\n627: \t\ttx.Rollback()\n628: \t\treturn err\n",
"line": "627",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "513: \t// edges' own dialect split).\n514: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS pipeline_templates (\n515: \t\tid TEXT PRIMARY KEY,\n516: \t\tname TEXT NOT NULL,\n517: \t\tdescription TEXT NOT NULL DEFAULT '',\n518: \t\ticon TEXT NOT NULL DEFAULT '',\n519: \t\tnodes JSONB NOT NULL DEFAULT '[]',\n520: \t\tedges JSONB NOT NULL DEFAULT '[]',\n521: \t\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n522: \t\tupdated_at TIMESTAMPTZ NOT NULL DEFAULT NOW())`)\n523: \tif err := s.seedPipelineTemplates(); err != nil {\n",
"line": "514-522",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "471: \t\tdismissed_at TIMESTAMPTZ)`)\n472: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_alerts_org ON alerts(org_id, created_at DESC)`)\n473: \t// Incident ownership and per-person read state (brokoli-ee#242),\n",
"line": "472",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "458: \t// dialect split).\n459: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS alerts (\n460: \t\tid TEXT PRIMARY KEY,\n461: \t\torg_id TEXT NOT NULL DEFAULT '',\n462: \t\tkind TEXT NOT NULL,\n463: \t\tseverity TEXT NOT NULL DEFAULT 'info',\n464: \t\ttitle TEXT NOT NULL,\n465: \t\tbody TEXT NOT NULL DEFAULT '',\n466: \t\tpipeline_id TEXT NOT NULL DEFAULT '',\n467: \t\tpipeline_name TEXT NOT NULL DEFAULT '',\n468: \t\trun_id TEXT NOT NULL DEFAULT '',\n469: \t\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n470: \t\tread_at TIMESTAMPTZ,\n471: \t\tdismissed_at TIMESTAMPTZ)`)\n472: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_alerts_org ON alerts(org_id, created_at DESC)`)\n",
"line": "459-471",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "452: \t// clobbering them with a guess.\n453: \ts.db.Exec(`UPDATE runs SET org_id = COALESCE((SELECT p.org_id FROM pipelines p WHERE p.id = runs.pipeline_id), org_id) WHERE org_id = 'default'`)\n454: \n",
"line": "453",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "413: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n414: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_expansion_instances_run_node ON expansion_instances(run_id, node_id, node_attempt)`)\n415: \n",
"line": "414",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "400: \t// column between backends.\n401: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS expansion_instances (\n402: \t\tid TEXT PRIMARY KEY,\n403: \t\trun_id TEXT NOT NULL,\n404: \t\tnode_id TEXT NOT NULL,\n405: \t\tnode_attempt INTEGER NOT NULL DEFAULT 0,\n406: \t\tinstance_index INTEGER NOT NULL,\n407: \t\tinstance_key TEXT NOT NULL DEFAULT '',\n408: \t\tstatus TEXT NOT NULL DEFAULT 'running',\n409: \t\trow_count INTEGER NOT NULL DEFAULT 0,\n410: \t\tstarted_at TIMESTAMPTZ,\n411: \t\tduration_ms BIGINT NOT NULL DEFAULT 0,\n412: \t\terror TEXT NOT NULL DEFAULT '',\n413: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n414: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_expansion_instances_run_node ON expansion_instances(run_id, node_id, node_attempt)`)\n",
"line": "401-413",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "388: \t// execution_attempts precedent above).\n389: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS scheduler_leader (\n390: \t\tid TEXT PRIMARY KEY,\n391: \t\tholder TEXT NOT NULL DEFAULT '',\n392: \t\tfencing_generation BIGINT NOT NULL DEFAULT 0,\n393: \t\tlease_expires_at TIMESTAMPTZ NOT NULL DEFAULT 'epoch',\n394: \t\tacquired_at TIMESTAMPTZ,\n395: \t\tupdated_at TIMESTAMPTZ NOT NULL DEFAULT NOW())`)\n396: \n",
"line": "389-395",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "377: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS cancel_requested BOOLEAN NOT NULL DEFAULT FALSE`) // #nosec G104 -- best-effort additive migration, same idiom as every ALTER above\n378: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_resumed_from ON runs(resumed_from_run_id) WHERE resumed_from_run_id != ''`)\n379: \n",
"line": "378",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "373: \tcreateRunAttributionTable(s.db, \"postgres\")\n374: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS uq_runs_scheduled_interval ON runs(pipeline_id, data_interval_start) WHERE trigger_type = 'scheduled' AND data_interval_start IS NOT NULL`)\n375: \t// Durable cancellation intent (see models.Run.CancelRequested and\n",
"line": "374",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "368: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS data_interval_start TIMESTAMPTZ`)\n369: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS data_interval_end TIMESTAMPTZ`)\n370: \t// #241: who started a run, in its own table. Created through one\n",
"line": "369",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "367: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS trigger_type TEXT NOT NULL DEFAULT ''`)\n368: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS data_interval_start TIMESTAMPTZ`)\n369: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS data_interval_end TIMESTAMPTZ`)\n",
"line": "368",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "366: \t// interval is a deliberate new run.\n367: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS trigger_type TEXT NOT NULL DEFAULT ''`)\n368: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS data_interval_start TIMESTAMPTZ`)\n",
"line": "367",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "359: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS pipeline_version INTEGER NOT NULL DEFAULT 0`)\n360: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS resumed_from_run_id TEXT NOT NULL DEFAULT ''`)\n361: \t// ADR-028: the data interval a scheduled run covers, and what created\n",
"line": "360",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "358: \t// column-for-column between backends.\n359: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS pipeline_version INTEGER NOT NULL DEFAULT 0`)\n360: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS resumed_from_run_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "359",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "353: \t// store/sqlite.go for why issue #8 makes this race worth guarding now.\n354: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_pipeline_versions_unique ON pipeline_versions(pipeline_id, version)`)\n355: \n",
"line": "354",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "331: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_execution_attempts_lease ON execution_attempts(status, lease_expires_at)`)\n332: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_execution_attempts_idempotency ON execution_attempts(idempotency_key)`)\n333: \n",
"line": "332",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "330: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n331: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_execution_attempts_lease ON execution_attempts(status, lease_expires_at)`)\n332: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_execution_attempts_idempotency ON execution_attempts(idempotency_key)`)\n",
"line": "331",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "315: \t// in sync column-for-column between backends.\n316: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS execution_attempts (\n317: \t\trun_id TEXT NOT NULL,\n318: \t\tnode_id TEXT NOT NULL DEFAULT '',\n319: \t\tinstance_key TEXT NOT NULL DEFAULT '',\n320: \t\tattempt INTEGER NOT NULL DEFAULT 0,\n321: \t\tstatus TEXT NOT NULL DEFAULT 'queued',\n322: \t\tclaimed_by TEXT NOT NULL DEFAULT '',\n323: \t\tlease_expires_at TIMESTAMPTZ,\n324: \t\tfencing_generation BIGINT NOT NULL DEFAULT 0,\n325: \t\tidempotency_key TEXT NOT NULL DEFAULT '',\n326: \t\terror TEXT NOT NULL DEFAULT '',\n327: \t\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n328: \t\tupdated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n329: \t\tPRIMARY KEY (run_id, node_id, instance_key, attempt),\n330: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n331: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_execution_attempts_lease ON execution_attempts(status, lease_expires_at)`)\n",
"line": "316-330",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "308: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_run_events_run ON run_events(run_id)`)\n309: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_run_events_run_node ON run_events(run_id, node_id)`)\n310: \n",
"line": "309",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "307: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n308: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_run_events_run ON run_events(run_id)`)\n309: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_run_events_run_node ON run_events(run_id, node_id)`)\n",
"line": "308",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "297: \t// applied idempotently here rather than through a tracked migration file.\n298: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS run_events (\n299: \t\tid BIGSERIAL PRIMARY KEY,\n300: \t\trun_id TEXT NOT NULL,\n301: \t\tnode_id TEXT,\n302: \t\tattempt INTEGER,\n303: \t\tevent_type TEXT NOT NULL,\n304: \t\tpayload JSONB NOT NULL DEFAULT '{}',\n305: \t\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n306: \t\tschema_version INTEGER NOT NULL DEFAULT 1,\n307: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE)`)\n308: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_run_events_run ON run_events(run_id)`)\n",
"line": "298-307",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "291: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS metadata TEXT NOT NULL DEFAULT '{}'`)\n292: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_runs_node_pipeline ON node_runs(node_id, run_id)`)\n293: \n",
"line": "292",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "290: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS attempt INTEGER NOT NULL DEFAULT 0`)\n291: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS metadata TEXT NOT NULL DEFAULT '{}'`)\n292: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_runs_node_pipeline ON node_runs(node_id, run_id)`)\n",
"line": "291",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "289: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS span_id TEXT NOT NULL DEFAULT ''`)\n290: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS attempt INTEGER NOT NULL DEFAULT 0`)\n291: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS metadata TEXT NOT NULL DEFAULT '{}'`)\n",
"line": "290",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "288: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS trace_id TEXT NOT NULL DEFAULT ''`)\n289: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS span_id TEXT NOT NULL DEFAULT ''`)\n290: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS attempt INTEGER NOT NULL DEFAULT 0`)\n",
"line": "289",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "287: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS span_id TEXT NOT NULL DEFAULT ''`)\n288: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS trace_id TEXT NOT NULL DEFAULT ''`)\n289: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS span_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "288",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "286: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS trace_id TEXT NOT NULL DEFAULT ''`)\n287: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS span_id TEXT NOT NULL DEFAULT ''`)\n288: \ts.db.Exec(`ALTER TABLE logs ADD COLUMN IF NOT EXISTS trace_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "287",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "285: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS rows_per_sec REAL NOT NULL DEFAULT 0`)\n286: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS trace_id TEXT NOT NULL DEFAULT ''`)\n287: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS span_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "286",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "284: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS queue_ms BIGINT NOT NULL DEFAULT 0`)\n285: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS rows_per_sec REAL NOT NULL DEFAULT 0`)\n286: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS trace_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "285",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "283: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS ready_at TIMESTAMPTZ`)\n284: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS queue_ms BIGINT NOT NULL DEFAULT 0`)\n285: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS rows_per_sec REAL NOT NULL DEFAULT 0`)\n",
"line": "284",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "282: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS attempt INTEGER NOT NULL DEFAULT 0`)\n283: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS ready_at TIMESTAMPTZ`)\n284: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS queue_ms BIGINT NOT NULL DEFAULT 0`)\n",
"line": "283",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "281: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS trace_id TEXT NOT NULL DEFAULT ''`)\n282: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS attempt INTEGER NOT NULL DEFAULT 0`)\n283: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS ready_at TIMESTAMPTZ`)\n",
"line": "282",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "280: \t// Tracing \u0026 observability columns\n281: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS trace_id TEXT NOT NULL DEFAULT ''`)\n282: \ts.db.Exec(`ALTER TABLE node_runs ADD COLUMN IF NOT EXISTS attempt INTEGER NOT NULL DEFAULT 0`)\n",
"line": "281",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "275: \t// Default workspace seed\n276: \ts.db.Exec(`INSERT INTO workspaces (id, name, slug, description, created_at, updated_at)\n277: \t\tVALUES ('default', 'Default', 'default', 'Default workspace', NOW(), NOW())\n278: \t\tON CONFLICT (id) DO NOTHING`)\n279: \n",
"line": "276-278",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "272: \t// Pipelines tags column\n273: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS tags JSONB NOT NULL DEFAULT '[]'`)\n274: \n",
"line": "273",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "269: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_pipeline_id ON runs(pipeline_id, id DESC)`)\n270: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_runs_run_status ON node_runs(run_id, status)`)\n271: \n",
"line": "270",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "268: \t// pipeline_id and ranges over id. Without this, every page is a scan.\n269: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_pipeline_id ON runs(pipeline_id, id DESC)`)\n270: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_runs_run_status ON node_runs(run_id, status)`)\n",
"line": "269",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "264: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_org ON runs(org_id)`)\n265: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_pipeline_status ON runs(pipeline_id, status, started_at DESC)`)\n266: \t// Backs the keyset walk in ListRunsByPipelineCursor. The status index\n",
"line": "265",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "263: \t}\n264: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_org ON runs(org_id)`)\n265: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_runs_pipeline_status ON runs(pipeline_id, status, started_at DESC)`)\n",
"line": "264",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "257: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS error TEXT NOT NULL DEFAULT ''`)\n258: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS params JSONB NOT NULL DEFAULT '{}'`)\n259: \t// ADR-032 rollout step 4 (#439): the resolved, typed run-parameter\n",
"line": "258",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "256: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS org_id TEXT NOT NULL DEFAULT 'default'`)\n257: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS error TEXT NOT NULL DEFAULT ''`)\n258: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS params JSONB NOT NULL DEFAULT '{}'`)\n",
"line": "257",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "255: \t// Runs table additions\n256: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS org_id TEXT NOT NULL DEFAULT 'default'`)\n257: \ts.db.Exec(`ALTER TABLE runs ADD COLUMN IF NOT EXISTS error TEXT NOT NULL DEFAULT ''`)\n",
"line": "256",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "252: \t)`)\n253: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_profiles ON node_profiles(run_id)`)\n254: \n",
"line": "253",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "242: \t// Node profiles table\n243: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS node_profiles (\n244: \t\trun_id TEXT NOT NULL,\n245: \t\tnode_id TEXT NOT NULL,\n246: \t\tprofile JSONB NOT NULL DEFAULT '{}',\n247: \t\tschema_snapshot JSONB NOT NULL DEFAULT '{}',\n248: \t\tdrift_alerts JSONB NOT NULL DEFAULT '[]',\n249: \t\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n250: \t\tPRIMARY KEY (run_id, node_id),\n251: \t\tFOREIGN KEY (run_id) REFERENCES runs(id) ON DELETE CASCADE\n252: \t)`)\n253: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_node_profiles ON node_profiles(run_id)`)\n",
"line": "243-252",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "236: \t// Settings key-value store\n237: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS settings (\n238: \t\tkey TEXT PRIMARY KEY,\n239: \t\tvalue TEXT NOT NULL DEFAULT ''\n240: \t)`)\n241: \n",
"line": "237-240",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "227: \t)`)\n228: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS oidc_group_mappings (\n229: \t\toidc_group TEXT NOT NULL,\n230: \t\tworkspace_id TEXT NOT NULL,\n231: \t\trole TEXT NOT NULL DEFAULT 'viewer',\n232: \t\tPRIMARY KEY (oidc_group, workspace_id),\n233: \t\tFOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE\n234: \t)`)\n235: \n",
"line": "228-234",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "215: \t)`)\n216: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS api_tokens (\n217: \t\tid TEXT PRIMARY KEY,\n218: \t\tname TEXT NOT NULL,\n219: \t\ttoken_hash TEXT NOT NULL UNIQUE,\n220: \t\tworkspace_id TEXT NOT NULL DEFAULT 'default',\n221: \t\tuser_id TEXT NOT NULL,\n222: \t\trole TEXT NOT NULL DEFAULT 'editor',\n223: \t\texpires_at TIMESTAMPTZ NOT NULL,\n224: \t\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n225: \t\tlast_used_at TIMESTAMPTZ,\n226: \t\tFOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE\n227: \t)`)\n228: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS oidc_group_mappings (\n",
"line": "216-227",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "206: \t)`)\n207: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS permissions (\n208: \t\tid TEXT PRIMARY KEY,\n209: \t\tworkspace_id TEXT NOT NULL,\n210: \t\tuser_id TEXT NOT NULL,\n211: \t\tresource TEXT NOT NULL DEFAULT '*',\n212: \t\tresource_id TEXT NOT NULL DEFAULT '*',\n213: \t\taction TEXT NOT NULL DEFAULT '*',\n214: \t\tFOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE\n215: \t)`)\n216: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS api_tokens (\n",
"line": "207-215",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "197: \t)`)\n198: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS workspace_members (\n199: \t\tworkspace_id TEXT NOT NULL,\n200: \t\tuser_id TEXT NOT NULL,\n201: \t\tusername TEXT NOT NULL DEFAULT '',\n202: \t\trole TEXT NOT NULL DEFAULT 'viewer',\n203: \t\tjoined_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n204: \t\tPRIMARY KEY (workspace_id, user_id),\n205: \t\tFOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE\n206: \t)`)\n207: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS permissions (\n",
"line": "198-206",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "189: \t// Workspaces + related tables\n190: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS workspaces (\n191: \t\tid TEXT PRIMARY KEY,\n192: \t\tname TEXT NOT NULL,\n193: \t\tslug TEXT NOT NULL UNIQUE,\n194: \t\tdescription TEXT NOT NULL DEFAULT '',\n195: \t\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n196: \t\tupdated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\n197: \t)`)\n198: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS workspace_members (\n",
"line": "190-197",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "186: \ts.db.Exec(`ALTER TABLE variables DROP CONSTRAINT IF EXISTS variables_pkey`)\n187: \ts.db.Exec(`ALTER TABLE variables ADD PRIMARY KEY (workspace_id, key)`)\n188: \n",
"line": "187",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "185: \ts.db.Exec(`UPDATE variables SET workspace_id = 'default' WHERE workspace_id IS NULL OR workspace_id = ''`)\n186: \ts.db.Exec(`ALTER TABLE variables DROP CONSTRAINT IF EXISTS variables_pkey`)\n187: \ts.db.Exec(`ALTER TABLE variables ADD PRIMARY KEY (workspace_id, key)`)\n",
"line": "186",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "184: \t// alter the constraint in place, so no table rebuild is needed.\n185: \ts.db.Exec(`UPDATE variables SET workspace_id = 'default' WHERE workspace_id IS NULL OR workspace_id = ''`)\n186: \ts.db.Exec(`ALTER TABLE variables DROP CONSTRAINT IF EXISTS variables_pkey`)\n",
"line": "185",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "179: \t)`)\n180: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_variables_workspace ON variables(workspace_id)`)\n181: \t// Widen the variables key from (key) to (workspace_id, key). See\n",
"line": "180",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "170: \t// Variables table\n171: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS variables (\n172: \t\tkey TEXT PRIMARY KEY,\n173: \t\tvalue TEXT NOT NULL DEFAULT '',\n174: \t\ttype TEXT NOT NULL DEFAULT 'string',\n175: \t\tdescription TEXT NOT NULL DEFAULT '',\n176: \t\tcreated_at TIMESTAMPTZ NOT NULL,\n177: \t\tupdated_at TIMESTAMPTZ NOT NULL,\n178: \t\tworkspace_id TEXT NOT NULL DEFAULT 'default'\n179: \t)`)\n180: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_variables_workspace ON variables(workspace_id)`)\n",
"line": "171-179",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "167: \ts.db.Exec(`UPDATE connections SET password_ref = 'encrypted://' || password_enc WHERE password_enc != '' AND password_ref = ''`)\n168: \ts.db.Exec(`UPDATE connections SET extra_ref = 'encrypted://' || extra_enc WHERE extra_enc != '' AND extra_ref = ''`)\n169: \n",
"line": "168",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "166: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS max_concurrent INTEGER NOT NULL DEFAULT 0`)\n167: \ts.db.Exec(`UPDATE connections SET password_ref = 'encrypted://' || password_enc WHERE password_enc != '' AND password_ref = ''`)\n168: \ts.db.Exec(`UPDATE connections SET extra_ref = 'encrypted://' || extra_enc WHERE extra_enc != '' AND extra_ref = ''`)\n",
"line": "167",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "165: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS extra_ref TEXT NOT NULL DEFAULT ''`)\n166: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS max_concurrent INTEGER NOT NULL DEFAULT 0`)\n167: \ts.db.Exec(`UPDATE connections SET password_ref = 'encrypted://' || password_enc WHERE password_enc != '' AND password_ref = ''`)\n",
"line": "166",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "164: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS password_ref TEXT NOT NULL DEFAULT ''`)\n165: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS extra_ref TEXT NOT NULL DEFAULT ''`)\n166: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS max_concurrent INTEGER NOT NULL DEFAULT 0`)\n",
"line": "165",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "163: \t// Credential references — external secret store pointers\n164: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS password_ref TEXT NOT NULL DEFAULT ''`)\n165: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS extra_ref TEXT NOT NULL DEFAULT ''`)\n",
"line": "164",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "161: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS workspace_id TEXT NOT NULL DEFAULT 'default'`)\n162: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS org_id TEXT NOT NULL DEFAULT 'default'`)\n163: \t// Credential references — external secret store pointers\n",
"line": "162",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "160: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_connections_org ON connections(org_id)`)\n161: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS workspace_id TEXT NOT NULL DEFAULT 'default'`)\n162: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS org_id TEXT NOT NULL DEFAULT 'default'`)\n",
"line": "161",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "159: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_connections_workspace ON connections(workspace_id)`)\n160: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_connections_org ON connections(org_id)`)\n161: \ts.db.Exec(`ALTER TABLE connections ADD COLUMN IF NOT EXISTS workspace_id TEXT NOT NULL DEFAULT 'default'`)\n",
"line": "160",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "158: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_connections_conn_id ON connections(conn_id)`)\n159: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_connections_workspace ON connections(workspace_id)`)\n160: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_connections_org ON connections(org_id)`)\n",
"line": "159",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "157: \t)`)\n158: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_connections_conn_id ON connections(conn_id)`)\n159: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_connections_workspace ON connections(workspace_id)`)\n",
"line": "158",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "141: \t// Connections table\n142: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS connections (\n143: \t\tid TEXT PRIMARY KEY,\n144: \t\tconn_id TEXT NOT NULL UNIQUE,\n145: \t\ttype TEXT NOT NULL,\n146: \t\tdescription TEXT NOT NULL DEFAULT '',\n147: \t\thost TEXT NOT NULL DEFAULT '',\n148: \t\tport INTEGER NOT NULL DEFAULT 0,\n149: \t\tschema_name TEXT NOT NULL DEFAULT '',\n150: \t\tlogin TEXT NOT NULL DEFAULT '',\n151: \t\tpassword_enc TEXT NOT NULL DEFAULT '',\n152: \t\textra_enc TEXT NOT NULL DEFAULT '',\n153: \t\tcreated_at TIMESTAMPTZ NOT NULL,\n154: \t\tupdated_at TIMESTAMPTZ NOT NULL,\n155: \t\tworkspace_id TEXT NOT NULL DEFAULT 'default',\n156: \t\torg_id TEXT NOT NULL DEFAULT 'default'\n157: \t)`)\n158: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_connections_conn_id ON connections(conn_id)`)\n",
"line": "142-157",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "138: \t\tFOREIGN KEY (pipeline_id) REFERENCES pipelines(id) ON DELETE CASCADE)`)\n139: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_dlq_pipeline ON dead_letter_queue(pipeline_id, resolved, created_at DESC)`)\n140: \n",
"line": "139",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "126: \t// Dead letter queue\n127: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS dead_letter_queue (\n128: \t\tid TEXT PRIMARY KEY,\n129: \t\tpipeline_id TEXT NOT NULL,\n130: \t\trun_id TEXT NOT NULL,\n131: \t\terror TEXT NOT NULL,\n132: \t\tnode_id TEXT NOT NULL DEFAULT '',\n133: \t\tnode_name TEXT NOT NULL DEFAULT '',\n134: \t\tpayload TEXT NOT NULL DEFAULT '{}',\n135: \t\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n136: \t\tresolved BOOLEAN NOT NULL DEFAULT FALSE,\n137: \t\tresolved_at TIMESTAMPTZ,\n138: \t\tFOREIGN KEY (pipeline_id) REFERENCES pipelines(id) ON DELETE CASCADE)`)\n139: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_dlq_pipeline ON dead_letter_queue(pipeline_id, resolved, created_at DESC)`)\n",
"line": "127-138",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "123: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_pipeline_pid ON pipelines(pipeline_id) WHERE pipeline_id != ''`)\n124: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_pipelines_workspace ON pipelines(workspace_id)`)\n125: \n",
"line": "124",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "122: \t}\n123: \ts.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_pipeline_pid ON pipelines(pipeline_id) WHERE pipeline_id != ''`)\n124: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_pipelines_workspace ON pipelines(workspace_id)`)\n",
"line": "123",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "107: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS workspace_id TEXT NOT NULL DEFAULT 'default'`)\n108: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS org_id TEXT NOT NULL DEFAULT ''`)\n109: \tif _, err := s.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS ir_version TEXT NOT NULL DEFAULT ''`); err != nil {\n",
"line": "108",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "106: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS source TEXT NOT NULL DEFAULT 'ui'`)\n107: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS workspace_id TEXT NOT NULL DEFAULT 'default'`)\n108: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS org_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "107",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "105: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS pipeline_id TEXT NOT NULL DEFAULT ''`)\n106: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS source TEXT NOT NULL DEFAULT 'ui'`)\n107: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS workspace_id TEXT NOT NULL DEFAULT 'default'`)\n",
"line": "106",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "104: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS webhook_token TEXT NOT NULL DEFAULT ''`)\n105: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS pipeline_id TEXT NOT NULL DEFAULT ''`)\n106: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS source TEXT NOT NULL DEFAULT 'ui'`)\n",
"line": "105",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "103: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS dependency_rules JSONB NOT NULL DEFAULT '[]'`)\n104: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS webhook_token TEXT NOT NULL DEFAULT ''`)\n105: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS pipeline_id TEXT NOT NULL DEFAULT ''`)\n",
"line": "104",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "102: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS depends_on JSONB NOT NULL DEFAULT '[]'`)\n103: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS dependency_rules JSONB NOT NULL DEFAULT '[]'`)\n104: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS webhook_token TEXT NOT NULL DEFAULT ''`)\n",
"line": "103",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "101: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS sla_timezone TEXT NOT NULL DEFAULT ''`)\n102: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS depends_on JSONB NOT NULL DEFAULT '[]'`)\n103: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS dependency_rules JSONB NOT NULL DEFAULT '[]'`)\n",
"line": "102",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "100: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS sla_deadline TEXT NOT NULL DEFAULT ''`)\n101: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS sla_timezone TEXT NOT NULL DEFAULT ''`)\n102: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS depends_on JSONB NOT NULL DEFAULT '[]'`)\n",
"line": "101",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "99: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_parked_waits_due ON parked_waits(next_poll_at)`)\n100: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS sla_deadline TEXT NOT NULL DEFAULT ''`)\n101: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS sla_timezone TEXT NOT NULL DEFAULT ''`)\n",
"line": "100",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "98: \t)`)\n99: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_parked_waits_due ON parked_waits(next_poll_at)`)\n100: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS sla_deadline TEXT NOT NULL DEFAULT ''`)\n",
"line": "99",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "88: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS draft BOOLEAN NOT NULL DEFAULT FALSE`)\n89: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS parked_waits (\n90: \t\trun_id TEXT PRIMARY KEY,\n91: \t\tpipeline_id TEXT NOT NULL,\n92: \t\tnode_id TEXT NOT NULL,\n93: \t\tcondition TEXT NOT NULL,\n94: \t\tpoll_interval_ms BIGINT NOT NULL,\n95: \t\tnext_poll_at TIMESTAMPTZ NOT NULL,\n96: \t\texpires_at TIMESTAMPTZ NOT NULL,\n97: \t\tcreated_at TIMESTAMPTZ NOT NULL\n98: \t)`)\n99: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_parked_waits_due ON parked_waits(next_poll_at)`)\n",
"line": "89-98",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "87: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS catchup BOOLEAN NOT NULL DEFAULT FALSE`)\n88: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS draft BOOLEAN NOT NULL DEFAULT FALSE`)\n89: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS parked_waits (\n",
"line": "88",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "86: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS schedule_timezone TEXT NOT NULL DEFAULT ''`)\n87: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS catchup BOOLEAN NOT NULL DEFAULT FALSE`)\n88: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS draft BOOLEAN NOT NULL DEFAULT FALSE`)\n",
"line": "87",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "85: \t// Pipeline schema additions (safe to re-run — errors ignored for existing columns)\n86: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS schedule_timezone TEXT NOT NULL DEFAULT ''`)\n87: \ts.db.Exec(`ALTER TABLE pipelines ADD COLUMN IF NOT EXISTS catchup BOOLEAN NOT NULL DEFAULT FALSE`)\n",
"line": "86",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "79: \t\t\tpermsJSON, _ := json.Marshal(role.Permissions)\n80: \t\t\ts.db.Exec(\"INSERT INTO roles (id, name, description, permissions, is_system, created_at) VALUES ($1,$2,$3,$4,$5,NOW())\",\n81: \t\t\t\trole.ID, role.Name, role.Description, string(permsJSON), role.IsSystem)\n82: \t\t}\n",
"line": "80-81",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "75: \tvar roleCount int\n76: \ts.db.QueryRow(\"SELECT COUNT(*) FROM roles\").Scan(\u0026roleCount)\n77: \tif roleCount == 0 {\n",
"line": "76",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "68: \t// Roles table\n69: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS roles (\n70: \t\tid TEXT PRIMARY KEY, name TEXT NOT NULL UNIQUE, description TEXT NOT NULL DEFAULT '',\n71: \t\tpermissions JSONB NOT NULL DEFAULT '[]', is_system BOOLEAN NOT NULL DEFAULT FALSE,\n72: \t\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW())`)\n73: \n",
"line": "69-72",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "65: \t\tattempted_at TIMESTAMPTZ NOT NULL DEFAULT NOW())`)\n66: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_login_attempts ON login_attempts(username, attempted_at DESC)`)\n67: \n",
"line": "66",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "59: \t// Login attempts tracking (account lockout)\n60: \ts.db.Exec(`CREATE TABLE IF NOT EXISTS login_attempts (\n61: \t\tid SERIAL PRIMARY KEY,\n62: \t\tusername TEXT NOT NULL,\n63: \t\tip TEXT NOT NULL DEFAULT '',\n64: \t\tsuccess BOOLEAN NOT NULL DEFAULT FALSE,\n65: \t\tattempted_at TIMESTAMPTZ NOT NULL DEFAULT NOW())`)\n66: \ts.db.Exec(`CREATE INDEX IF NOT EXISTS idx_login_attempts ON login_attempts(username, attempted_at DESC)`)\n",
"line": "60-65",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "43: \tif err := s.migrate(); err != nil {\n44: \t\tdb.Close()\n45: \t\treturn nil, fmt.Errorf(\"migrate: %w\", err)\n",
"line": "44",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/store/postgres.go",
"code": "37: \tif err := db.Ping(); err != nil {\n38: \t\tdb.Close()\n39: \t\treturn nil, fmt.Errorf(\"ping postgres: %w\", err)\n",
"line": "38",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/pkg/sodp/server.go",
"code": "221: \t\tcase \u003c-ticker.C:\n222: \t\t\tconn.SetWriteDeadline(time.Now().Add(serverWriteWait))\n223: \t\t\tif err := conn.WriteMessage(websocket.PingMessage, nil); err != nil {\n",
"line": "222",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/pkg/sodp/server.go",
"code": "209: \t\t\t}\n210: \t\t\tconn.SetWriteDeadline(time.Now().Add(serverWriteWait))\n211: \t\t\tif err := conn.WriteMessage(websocket.BinaryMessage, msg); err != nil {\n",
"line": "210",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/pkg/sodp/server.go",
"code": "206: \t\t\tif !ok {\n207: \t\t\t\tconn.WriteMessage(websocket.CloseMessage, []byte{})\n208: \t\t\t\treturn\n",
"line": "207",
"column": "5",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/pkg/sodp/server.go",
"code": "173: \tsrv.sessionCount.Add(-1)\n174: \tconn.Close()\n175: }\n",
"line": "174",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/pkg/sodp/server.go",
"code": "156: \t\tconn.SetWriteDeadline(time.Now().Add(serverWriteWait))\n157: \t\tconn.WriteMessage(websocket.BinaryMessage, data)\n158: \t}\n",
"line": "157",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/pkg/sodp/server.go",
"code": "155: \t}); err == nil {\n156: \t\tconn.SetWriteDeadline(time.Now().Add(serverWriteWait))\n157: \t\tconn.WriteMessage(websocket.BinaryMessage, data)\n",
"line": "156",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/pkg/sodp/server.go",
"code": "140: \tconn.SetPongHandler(func(string) error {\n141: \t\tconn.SetReadDeadline(time.Now().Add(serverPongWait))\n142: \t\treturn nil\n",
"line": "141",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/pkg/sodp/server.go",
"code": "138: \t// Configure keepalive\n139: \tconn.SetReadDeadline(time.Now().Add(serverPongWait))\n140: \tconn.SetPongHandler(func(string) error {\n",
"line": "139",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/pkg/secrets/vault.go",
"code": "144: \tif resp.StatusCode != 200 {\n145: \t\tio.Copy(io.Discard, io.LimitReader(resp.Body, 512))\n146: \t\treturn \"\", fmt.Errorf(\"vault k8s auth failed with HTTP %d\", resp.StatusCode)\n",
"line": "145",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/pkg/secrets/vault.go",
"code": "79: \tif resp.StatusCode != 200 {\n80: \t\tio.Copy(io.Discard, io.LimitReader(resp.Body, 512))\n81: \t\treturn \"\", fmt.Errorf(\"secrets/vault: HTTP %d for path\", resp.StatusCode)\n",
"line": "80",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/runner.go",
"code": "2248: \t}\n2249: \tresp.Body.Close()\n2250: \tr.log(\"\", models.LogLevelInfo, \"Hook %s fired: HTTP %d\", hookName, resp.StatusCode)\n",
"line": "2249",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/notify.go",
"code": "43: \t}\n44: \tresp.Body.Close()\n45: \tlog.Printf(\"webhook: POST %s -\u003e %d\", url, resp.StatusCode)\n",
"line": "44",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/node_handlers.go",
"code": "1289: \t\t}\n1290: \t\tresp.Body.Close()\n1291: \t\tif resp.StatusCode \u003e= 400 {\n",
"line": "1290",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/engine.go",
"code": "531: \t\trun.FinishedAt = \u0026now\n532: \t\te.store.UpdateRun(run)\n533: \t\te.appendEvent(\u0026models.RunEvent{\n",
"line": "532",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/database.go",
"code": "269: \t\tif err != nil {\n270: \t\t\ttx.Rollback()\n271: \t\t\treturn 0, fmt.Errorf(\"exec: %w\", err)\n",
"line": "270",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/connector.go",
"code": "155: \t}\n156: \tresp.Body.Close()\n157: \n",
"line": "156",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/connection_resolver.go",
"code": "98: \tif conn.Extra != \"\" {\n99: \t\tjson.Unmarshal([]byte(conn.Extra), \u0026extra)\n100: \t}\n",
"line": "99",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/codenode.go",
"code": "101: \t\t\t// Fall back to CSV\n102: \t\t\tos.Remove(inputNDJSON)\n103: \t\t\tinputNDJSON = \"\"\n",
"line": "102",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/bulk_mysql.go",
"code": "165: \t\t\t// backstop if this errors.\n166: \t\t\tconn.ExecContext(ctx, \"SELECT RELEASE_LOCK(?)\", lockName) //nolint:errcheck\n167: \t\t}()\n",
"line": "166",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/bulk_mysql.go",
"code": "131: \t\tif !committed {\n132: \t\t\ttx.Rollback() //nolint:errcheck // best-effort on the error path\n133: \t\t}\n",
"line": "132",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/alerts.go",
"code": "176: \t}\n177: \tresp.Body.Close()\n178: }\n",
"line": "177",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/alerts.go",
"code": "131: \t}\n132: \tresp.Body.Close()\n133: }\n",
"line": "132",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/engine/alerts.go",
"code": "99: \t}\n100: \tresp.Body.Close()\n101: }\n",
"line": "100",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/crypto/crypto.go",
"code": "117: \tif dir != \"\" \u0026\u0026 dir != \".\" {\n118: \t\tos.MkdirAll(dir, 0o700)\n119: \t}\n",
"line": "118",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/test.go",
"code": "40: \t\t\t}\n41: \t\t\tjson.NewEncoder(os.Stdout).Encode(result)\n42: \t\t\tif ve.HasErrors() {\n",
"line": "41",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/serve.go",
"code": "416: \t\t\t\t\t\tif data, err := json.Marshal(event); err == nil {\n417: \t\t\t\t\t\t\tExtensions.EventBus.Publish(channel, data)\n418: \t\t\t\t\t\t}\n",
"line": "417",
"column": "8",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/runcmd.go",
"code": "147: \tdeadline := time.Now().Add(time.Duration(timeoutSec) * time.Second)\n148: \tconn.SetReadDeadline(deadline)\n149: \n",
"line": "148",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/runcmd.go",
"code": "106: \t\tjson.NewDecoder(resp.Body).Decode(\u0026status)\n107: \t\tresp.Body.Close()\n108: \n",
"line": "107",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/runcmd.go",
"code": "105: \t\tvar status runResponse\n106: \t\tjson.NewDecoder(resp.Body).Decode(\u0026status)\n107: \t\tresp.Body.Close()\n",
"line": "106",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/plugins.go",
"code": "266: \t\tin.Close()\n267: \t\tout.Close()\n268: \t}\n",
"line": "267",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/plugins.go",
"code": "265: \t\t}\n266: \t\tin.Close()\n267: \t\tout.Close()\n",
"line": "266",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/plugins.go",
"code": "262: \t\t\tin.Close()\n263: \t\t\tout.Close()\n264: \t\t\treturn err\n",
"line": "263",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/plugins.go",
"code": "261: \t\tif _, err := io.Copy(out, in); err != nil {\n262: \t\t\tin.Close()\n263: \t\t\tout.Close()\n",
"line": "262",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/plugins.go",
"code": "257: \t\tif err != nil {\n258: \t\t\tin.Close()\n259: \t\t\treturn err\n",
"line": "258",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/migrate.go",
"code": "241: \t\tif err := rows.Scan(ptrs...); err != nil {\n242: \t\t\ttx.Rollback()\n243: \t\t\treturn count, fmt.Errorf(\"scan row %d: %w\", count, err)\n",
"line": "242",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/migrate.go",
"code": "227: \tif err != nil {\n228: \t\ttx.Rollback()\n229: \t\treturn 0, fmt.Errorf(\"prepare: %w\", err)\n",
"line": "228",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/migrate.go",
"code": "193: \tvar count int\n194: \tdb.QueryRow(fmt.Sprintf(\"SELECT COUNT(*) FROM %s\", table)).Scan(\u0026count)\n195: \treturn count\n",
"line": "194",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/migrate.go",
"code": "132: \tfor i := len(tables) - 1; i \u003e= 0; i-- {\n133: \t\tdstDB.Exec(fmt.Sprintf(\"DELETE FROM %s\", tables[i].name))\n134: \t}\n",
"line": "133",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/migrate.go",
"code": "42: \tmigrateCmd.MarkFlagRequired(\"from\")\n43: \tmigrateCmd.MarkFlagRequired(\"to\")\n44: \trootCmd.AddCommand(migrateCmd)\n",
"line": "43",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/migrate.go",
"code": "41: \tmigrateCmd.Flags().BoolVar(\u0026dryRun, \"dry-run\", false, \"Show what would be migrated without executing\")\n42: \tmigrateCmd.MarkFlagRequired(\"from\")\n43: \tmigrateCmd.MarkFlagRequired(\"to\")\n",
"line": "42",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/cmd/auth.go",
"code": "196: \t\tvar me map[string]interface{}\n197: \t\tjson.NewDecoder(resp.Body).Decode(\u0026me)\n198: \t\tusername, _ := me[\"username\"].(string)\n",
"line": "197",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/users.go",
"code": "223: \tif role == \"\" {\n224: \t\tus.db.QueryRow(`SELECT role FROM users WHERE id = $1`, userID).Scan(\u0026role)\n225: \t}\n",
"line": "224",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/users.go",
"code": "221: \tvar role string\n222: \tus.db.QueryRow(us.q(`SELECT role FROM users WHERE id = ?`), userID).Scan(\u0026role)\n223: \tif role == \"\" {\n",
"line": "222",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/server.go",
"code": "510: \t\tw.WriteHeader(rec.statusCode)\n511: \t\tw.Write(rec.body)\n512: \t}\n",
"line": "511",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/server.go",
"code": "483: \tw.WriteHeader(status)\n484: \tjson.NewEncoder(w).Encode(data)\n485: }\n",
"line": "484",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/server.go",
"code": "266: \t\t\tw.Header().Set(\"Content-Type\", \"text/html\")\n267: \t\t\tw.Write(indexData)\n268: \t\t})\n",
"line": "267",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/server.go",
"code": "250: \t\t\tif err == nil {\n251: \t\t\t\tf.Close()\n252: \t\t\t\t// Cache static assets (JS/CSS have content hashes in filenames)\n",
"line": "251",
"column": "5",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_run.go",
"code": "408: \t\tline += \" \" + l.Message + \"\\n\"\n409: \t\tw.Write([]byte(line))\n410: \t}\n",
"line": "409",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_run.go",
"code": "77: \t}\n78: \tjson.NewDecoder(r.Body).Decode(\u0026req) // ignore error — body may be empty\n79: \n",
"line": "78",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_pipeline.go",
"code": "994: \tw.Header().Set(\"Content-Disposition\", fmt.Sprintf(`attachment; filename=\"%s.yaml\"`, safeName))\n995: \tw.Write(yamlData) //nolint:errcheck\n996: }\n",
"line": "995",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_pipeline.go",
"code": "900: \t\tvar newConfig map[string]interface{}\n901: \t\tjson.Unmarshal(configJSON, \u0026newConfig)\n902: \t\tnewNodes[i].Config = newConfig\n",
"line": "901",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_pipeline.go",
"code": "719: \n720: \th.store.SavePipelineVersion(p.ID, snapshot, fmt.Sprintf(\"rollback to v%d\", req.Version))\n721: \n",
"line": "720",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_pipeline.go",
"code": "409: \tsnapshot, _ := json.Marshal(p)\n410: \th.store.SavePipelineVersion(p.ID, string(snapshot), \"\")\n411: \n",
"line": "410",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_pipeline.go",
"code": "266: \tsnapshot, _ := json.Marshal(p)\n267: \th.store.SavePipelineVersion(p.ID, string(snapshot), \"initial version\")\n268: \n",
"line": "267",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_misc.go",
"code": "979: \th.store.SetSetting(\"slack_username\", \"\")\n980: \th.store.SetSetting(\"teams_webhook\", \"\")\n981: \twriteJSON(w, http.StatusOK, map[string]string{\"status\": \"cleared\"})\n",
"line": "980",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_misc.go",
"code": "978: \th.store.SetSetting(\"slack_channel\", \"\")\n979: \th.store.SetSetting(\"slack_username\", \"\")\n980: \th.store.SetSetting(\"teams_webhook\", \"\")\n",
"line": "979",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_misc.go",
"code": "977: \th.store.SetSetting(\"slack_webhook\", \"\")\n978: \th.store.SetSetting(\"slack_channel\", \"\")\n979: \th.store.SetSetting(\"slack_username\", \"\")\n",
"line": "978",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_misc.go",
"code": "976: func (h *NotificationSettingsHandler) Delete(w http.ResponseWriter, r *http.Request) {\n977: \th.store.SetSetting(\"slack_webhook\", \"\")\n978: \th.store.SetSetting(\"slack_channel\", \"\")\n",
"line": "977",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_misc.go",
"code": "966: \t}\n967: \tresp.Body.Close()\n968: \tif resp.StatusCode \u003e= 400 {\n",
"line": "967",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_misc.go",
"code": "921: \tif req.TeamsWebhook != \"\" {\n922: \t\th.store.SetSetting(\"teams_webhook\", req.TeamsWebhook)\n923: \t}\n",
"line": "922",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_misc.go",
"code": "919: \th.store.SetSetting(\"slack_channel\", req.Channel)\n920: \th.store.SetSetting(\"slack_username\", req.Username)\n921: \tif req.TeamsWebhook != \"\" {\n",
"line": "920",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_misc.go",
"code": "918: \t}\n919: \th.store.SetSetting(\"slack_channel\", req.Channel)\n920: \th.store.SetSetting(\"slack_username\", req.Username)\n",
"line": "919",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_misc.go",
"code": "916: \tif req.Webhook != \"\" {\n917: \t\th.store.SetSetting(\"slack_webhook\", req.Webhook)\n918: \t}\n",
"line": "917",
"column": "3",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_connection.go",
"code": "637: \t}\n638: \tconn.Close()\n639: \treturn map[string]interface{}{\n",
"line": "638",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_connection.go",
"code": "487: \t// Read SSH banner (e.g. \"SSH-2.0-OpenSSH_8.9\")\n488: \tconn.SetReadDeadline(time.Now().Add(3 * time.Second))\n489: \tbuf := make([]byte, 256)\n",
"line": "488",
"column": "2",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/handlers_connection.go",
"code": "346: \t\t\tc.Extra = dec\n347: \t\t\tjson.Unmarshal([]byte(dec), \u0026extra)\n348: \t\t}\n",
"line": "347",
"column": "4",
"nosec": false,
"suppressions": null
},
{
"severity": "LOW",
"confidence": "HIGH",
"cwe": {
"id": "703",
"url": "https://cwe.mitre.org/data/definitions/703.html"
},
"rule_id": "G104",
"details": "Errors unhandled",
"file": "/src/api/audit_hook.go",
"code": "58: \t}\n59: \tauditLogger.Log(entry)\n60: }\n",
"line": "59",
"column": "2",
"nosec": false,
"suppressions": null
}
],
"Stats": {
"files": 272,
"lines": 73096,
"nosec": 61,
"found": 351
},
"GosecVersion": "dev"
}