XR007

README

XR007

The XR007 analyzer reports usage of the os/exec.Command() function. Providers that are using Go language based SDKs likely want to prevent any execution of other binaries for various reasons such as security and unexpected requirements (e.g. tool installation outside Terraform).

Flagged Code

var sneaky = exec.Command

sneaky("evilprogram")

exec.Command("evilprogram")

Passing Code

// Not present :)

Ignoring Reports

Singular reports can be ignored by adding the a //lintignore:XR007 Go code comment at the end of the offending line or on the line immediately proceding, e.g.

//lintignore:XR007
exec.Command("evilprogram")

Documentation

Index

• Variables

Variables

var Analyzer = analysisutils.AvoidSelectorExprAnalyzer(
	"XR007",
	osexeccommandcallexpr.Analyzer,
	osexeccommandselectorexpr.Analyzer,
	"os/exec",
	"Command",
)