From a10dba6d37353d25989502e52facaae87452a5b1 Mon Sep 17 00:00:00 2001 From: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com> Date: Wed, 10 Jun 2026 23:54:14 +0530 Subject: [PATCH] Fix: resolve gosec G304 lint failure in Terraform module cache check (#7190) Wrap the cache remote marker read in filepath.Clean, the same pattern other os.ReadFile call sites in this repo use to satisfy gosec. The path is built from filepath.Join and a constant suffix, with the module name validated beforehand, so behavior is unchanged. The finding surfaced on master after the GHSA-fmgp-q6jx-gg3x merge because the advisory workflow did not run the full lint job. Signed-off-by: Ayush Kumar --- pkg/controller/utils/capability.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/controller/utils/capability.go b/pkg/controller/utils/capability.go index 03ea5499d..4840b38c4 100644 --- a/pkg/controller/utils/capability.go +++ b/pkg/controller/utils/capability.go @@ -268,7 +268,7 @@ func cacheMatchesRemote(cachePath, remoteURL string) bool { if err != nil || len(entities) == 0 { return false } - recorded, err := os.ReadFile(cachePath + cacheRemoteMarkerSuffix) + recorded, err := os.ReadFile(filepath.Clean(cachePath + cacheRemoteMarkerSuffix)) if err != nil { return false }