From f33a306c47b7e707285276e213fb103d0b1608c4 Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Sun, 9 Aug 2026 01:17:16 +0200 Subject: [PATCH] chore: suppress math/rand Semgrep finding on two non-security use sites Addresses the Semgrep finding on PR #599 (go.lang.security.audit.crypto.math_random.math-random-used) on the update-check jitter delay, and applies the same treatment to the #419 activity-log filename suffix, which has the same non-security shape but predates this PR's diff so it wasn't flagged. Neither value is ever compared, kept secret, or otherwise security- sensitive (a sleep duration and a filename-uniqueness suffix), so crypto/rand would only add error-handling overhead for no real benefit. Suppressed with the same // nosemgrep: pattern already used in the mock-amazon/mock-spotify/mock-tunein servers, mirroring the existing //nolint:gosec on the same lines. Refs #591 --- cmd/soundtouch-service/main.go | 1 + pkg/service/datastore/datastore.go | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/cmd/soundtouch-service/main.go b/cmd/soundtouch-service/main.go index 9b2e9d6..d9e3adf 100644 --- a/cmd/soundtouch-service/main.go +++ b/cmd/soundtouch-service/main.go @@ -1273,6 +1273,7 @@ func randomJitter(upperBound time.Duration) time.Duration { return 0 } + // nosemgrep: go.lang.security.audit.crypto.math_random.math-random-used return time.Duration(rand.Int63n(int64(upperBound))) //nolint:gosec } diff --git a/pkg/service/datastore/datastore.go b/pkg/service/datastore/datastore.go index 04d0621..124d171 100644 --- a/pkg/service/datastore/datastore.go +++ b/pkg/service/datastore/datastore.go @@ -2818,7 +2818,10 @@ func (ds *DataStore) RecordActivity(kind, id string, detail map[string]interface // The random suffix guards against two events for the same id landing in // the same nanosecond (observed as flaky on coarser-resolution clocks) - // silently overwriting one another instead of both being recorded. + // silently overwriting one another instead of both being recorded. Not + // a security-sensitive use of randomness — only affects filename + // uniqueness, not any value that's compared or kept secret. + // nosemgrep: go.lang.security.audit.crypto.math_random.math-random-used filename := fmt.Sprintf("%d_%d_%s.json", now.UnixNano(), rand.Int63n(1_000_000), id) //nolint:gosec path := filepath.Join(dir, filename)