XR008

README

XR008

The XR008 analyzer reports usage of the os/exec.CommandContext() function. Providers that are using Go language based SDKs likely want to prevent any execution of other binaries for various reasons such as security and unexpected requirements (e.g. tool installation outside Terraform).

Flagged Code

var sneaky = exec.CommandContext

sneaky("evilprogram")

exec.CommandContext("evilprogram")

Passing Code

// Not present :)

Ignoring Reports

Singular reports can be ignored by adding the a //lintignore:XR008 Go code comment at the end of the offending line or on the line immediately proceding, e.g.

//lintignore:XR008
exec.CommandContext("evilprogram")

Documentation

Index

• Variables

Variables

var Analyzer = analysisutils.AvoidSelectorExprAnalyzer(
	"XR008",
	osexeccommandcontextcallexpr.Analyzer,
	osexeccommandcontextselectorexpr.Analyzer,
	"os/exec",
	"CommandContext",
)