chore: fix github code scanning alerts (#9635)

leon-ape · web-flow · commit 65b4a2db3f0c · 2025-08-19T15:00:26.000+08:00
diff --git a/pkg/common/password.go b/pkg/common/password.go
@@ -22,7 +22,7 @@ package common
 import (
 	"crypto/sha256"
 	"encoding/binary"
-	mathrand "math/rand"
+	"math/rand"
 	"strings"
 	"time"
 	"unicode"
@@ -33,24 +33,24 @@ import (
 )
 
 const (
-	// DefaultSymbols is the list of default symbols to generate password.
-	DefaultSymbols = "!@#&*"
+	// defaultSymbols is the list of default symbols to generate password.
+	defaultSymbols = "!@#&*"
 )
 
-type PasswordReader struct {
-	rand *mathrand.Rand
+type passwordReader struct {
+	rand *rand.Rand
 }
 
-func (r *PasswordReader) Read(data []byte) (int, error) {
+func (r *passwordReader) Read(data []byte) (int, error) {
 	return r.rand.Read(data)
 }
 
-func (r *PasswordReader) Seed(seed int64) {
+func (r *passwordReader) Seed(seed int64) {
 	r.rand.Seed(seed)
 }
 
 func GeneratePasswordByConfig(config appsv1.PasswordConfig) (string, error) {
-	passwd, err := GeneratePassword((int)(config.Length), (int)(config.NumDigits), (int)(config.NumSymbols), config.Seed, config.SymbolCharacters)
+	passwd, err := generatePassword((int)(config.Length), (int)(config.NumDigits), (int)(config.NumSymbols), config.Seed, config.SymbolCharacters)
 	if err != nil {
 		return "", err
 	}
@@ -60,38 +60,38 @@ func GeneratePasswordByConfig(config appsv1.PasswordConfig) (string, error) {
 	case appsv1.LowerCases:
 		passwd = strings.ToLower(passwd)
 	case appsv1.MixedCases:
-		passwd, err = EnsureMixedCase(passwd, config.Seed)
+		passwd, err = ensureMixedCase(passwd, config.Seed)
 	}
 	return passwd, err
 }
 
-// GeneratePassword generates a password with the given requirements and seed in lowercase.
-func GeneratePassword(length, numDigits, numSymbols int, seed string, symbols string) (string, error) {
-	rand, err := newRngFromSeed(seed)
+// generatePassword generates a password with the given requirements and seed in lowercase.
+func generatePassword(length, numDigits, numSymbols int, seed string, symbols string) (string, error) {
+	// #nosec G404
+	rand, err := newRandFromSeed(seed)
 	if err != nil {
 		return "", err
 	}
-	passwordReader := &PasswordReader{rand: rand}
 	if symbols == "" {
-		symbols = DefaultSymbols
+		symbols = defaultSymbols
 	}
 	gen, err := password.NewGenerator(&password.GeneratorInput{
 		LowerLetters: password.LowerLetters,
 		UpperLetters: password.UpperLetters,
 		Symbols:      symbols,
 		Digits:       password.Digits,
-		Reader:       passwordReader,
+		Reader:       &passwordReader{rand: rand},
 	})
 	if err != nil {
 		return "", err
 	}
 	return gen.Generate(length, numDigits, numSymbols, true, true)
 }
 
-// EnsureMixedCase randomizes the letter casing in the given string, ensuring
+// ensureMixedCase randomizes the letter casing in the given string, ensuring
 // that the result contains at least one uppercase and one lowercase letter.
 // If the give string only has one letter, it is returned unmodified.
-func EnsureMixedCase(in, seed string) (string, error) {
+func ensureMixedCase(in, seed string) (string, error) {
 	runes := []rune(in)
 	letterIndices := make([]int, 0, len(runes))
 	for i, r := range runes {
@@ -107,11 +107,11 @@ func EnsureMixedCase(in, seed string) (string, error) {
 
 	// Get a random number x in [1, 2^L - 2], whose binary list will be used to determine the letter casing.
 	// avoid the all-0 and all-1 patterns, which cause all-lowercase and all-uppercase password.
-	rng, err := newRngFromSeed(seed)
+	rand, err := newRandFromSeed(seed)
 	if err != nil {
 		return in, err
 	}
-	x := uint64(rng.Int63n(int64((1<<L)-2))) + 1
+	x := uint64(rand.Int63n(int64((1<<L)-2))) + 1
 
 	for i := 0; i < L; i++ {
 		bit := (x >> i) & 1
@@ -125,11 +125,9 @@ func EnsureMixedCase(in, seed string) (string, error) {
 	return string(runes), nil
 }
 
-// newRngFromSeed initializes a *mathrand.Rand from the given seed. If seed is empty,
-// it uses the current time, making the output non-deterministic.
-func newRngFromSeed(seed string) (*mathrand.Rand, error) {
+func newRandFromSeed(seed string) (*rand.Rand, error) {
 	if seed == "" {
-		return mathrand.New(mathrand.NewSource(time.Now().UnixNano())), nil
+		return rand.New(rand.NewSource(time.Now().UnixNano())), nil
 	}
 	// Convert seed string to a 64-bit integer via SHA-256
 	h := sha256.New()
@@ -138,5 +136,5 @@ func newRngFromSeed(seed string) (*mathrand.Rand, error) {
 	}
 	sum := h.Sum(nil)
 	uSeed := binary.BigEndian.Uint64(sum)
-	return mathrand.New(mathrand.NewSource(int64(uSeed))), nil
+	return rand.New(rand.NewSource(int64(uSeed))), nil
 }
diff --git a/pkg/common/password_test.go b/pkg/common/password_test.go
@@ -35,7 +35,7 @@ func testGeneratorGeneratePasswordWithSeed(t *testing.T) {
 	resultSeedFirstTime := ""
 	resultSeedEachTime := ""
 	for i := 0; i < N; i++ {
-		res, err := GeneratePassword(10, 5, 0, seed, "")
+		res, err := generatePassword(10, 5, 0, seed, "")
 		if err != nil {
 			t.Error(err)
 		}
@@ -53,11 +53,11 @@ func testGeneratorGeneratePassword(t *testing.T) {
 	t.Run("exceeds_length", func(t *testing.T) {
 		t.Parallel()
 
-		if _, err := GeneratePassword(0, 1, 0, "", ""); err != password.ErrExceedsTotalLength {
+		if _, err := generatePassword(0, 1, 0, "", ""); err != password.ErrExceedsTotalLength {
 			t.Errorf("expected %q to be %q", err, password.ErrExceedsTotalLength)
 		}
 
-		if _, err := GeneratePassword(0, 0, 1, "", ""); err != password.ErrExceedsTotalLength {
+		if _, err := generatePassword(0, 0, 1, "", ""); err != password.ErrExceedsTotalLength {
 			t.Errorf("expected %q to be %q", err, password.ErrExceedsTotalLength)
 		}
 	})
@@ -67,7 +67,7 @@ func testGeneratorGeneratePassword(t *testing.T) {
 
 		symbols := "!$_#"
 		for i := 0; i < N; i++ {
-			res, err := GeneratePassword(10, 0, 5, "", symbols)
+			res, err := generatePassword(10, 0, 5, "", symbols)
 			if err != nil {
 				t.Error(err)
 			}
@@ -89,7 +89,7 @@ func testGeneratorGeneratePassword(t *testing.T) {
 		resultSeedEachTime := ""
 		hasDiffPassword := false
 		for i := 0; i < N; i++ {
-			res, err := GeneratePassword(i%(len(password.LowerLetters)+len(password.UpperLetters)), 0, 0, "", "")
+			res, err := generatePassword(i%(len(password.LowerLetters)+len(password.UpperLetters)), 0, 0, "", "")
 			if err != nil {
 				t.Error(err)
 			}
@@ -148,11 +148,11 @@ func TestGeneratorEnsureMixedCase(t *testing.T) {
 
 		// Generate multiple passwords and check they have both upper and lower letters.
 		for i := 0; i < 100; i++ {
-			pwd, err := GeneratePassword(length, numDigits, numSymbols, seed, "")
+			pwd, err := generatePassword(length, numDigits, numSymbols, seed, "")
 			if err != nil {
 				t.Fatalf("unexpected error generating password: %v", err)
 			}
-			pwd, err = EnsureMixedCase(pwd, seed)
+			pwd, err = ensureMixedCase(pwd, seed)
 			if err != nil {
 				t.Fatalf("unexpected error Ensuring mixed-case password: %v", err)
 			}
@@ -170,11 +170,11 @@ func TestGeneratorEnsureMixedCase(t *testing.T) {
 
 		var firstPwd string
 		for i := 0; i < 50; i++ {
-			pwd, err := GeneratePassword(length, numDigits, numSymbols, seed, "")
+			pwd, err := generatePassword(length, numDigits, numSymbols, seed, "")
 			if err != nil {
 				t.Fatalf("unexpected error generating password with seed: %v", err)
 			}
-			pwd, err = EnsureMixedCase(pwd, seed)
+			pwd, err = ensureMixedCase(pwd, seed)
 			if err != nil {
 				t.Fatalf("unexpected error Ensuring mixed-case password: %v", err)
 			}
diff --git a/pkg/controller/component/workload_utils.go b/pkg/controller/component/workload_utils.go
@@ -231,7 +231,7 @@ func GetTemplateNameAndOrdinal(workloadName, podName string) (string, int32, err
 		templateName = podSuffix[0:lastDashIndex]
 		indexStr = podSuffix[lastDashIndex+1:]
 	}
-	index, err := strconv.Atoi(indexStr)
+	index, err := strconv.ParseInt(indexStr, 10, 32)
 	if err != nil {
 		return "", 0, fmt.Errorf("failed to obtain pod ordinal")
 	}
diff --git a/pkg/controller/sharding/legacy.go b/pkg/controller/sharding/legacy.go
@@ -132,7 +132,7 @@ func listShardingCompSpecs4Test(ctx context.Context, cli client.Reader,
 		return nil, err
 	}
 
-	compSpecList := make([]*appsv1.ClusterComponentSpec, 0, len(undeletedShardingComps)+len(deletingShardingComps))
+	compSpecList := make([]*appsv1.ClusterComponentSpec, 0)
 	shardTpl := sharding.Template
 
 	processComps := func(comps []appsv1.Component) error {
diff --git a/pkg/kbagent/service/reconfigure.go b/pkg/kbagent/service/reconfigure.go
@@ -107,6 +107,7 @@ func checkReconfigureUpdated(req *proto.ActionRequest) error {
 }
 
 func checkLocalFileExist(file string) (bool, error) {
+	// #nosec G304
 	_, err := os.Stat(file)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -118,6 +119,7 @@ func checkLocalFileExist(file string) (bool, error) {
 }
 
 func checkLocalFileUpToDate(file, checksum string) error {
+	// #nosec G304
 	content, err := os.ReadFile(file)
 	if err != nil {
 		return err
diff --git a/pkg/operations/horizontal_scaling.go b/pkg/operations/horizontal_scaling.go
@@ -283,7 +283,7 @@ func (hs horizontalScalingOpsHandler) restoreDataFromBackup(reqCtx intctrlutil.R
 	for podName, templateName := range createdPodSet {
 		idx := strings.LastIndex(podName, "-")
 		podIndex := podName[idx+1:]
-		podIndexInt, _ := strconv.Atoi(podIndex)
+		podIndexInt, _ := strconv.ParseInt(podIndex, 10, 32)
 		restoreMGR := plan.NewRestoreManager(reqCtx.Ctx, cli, opsRes.Cluster, model.GetScheme(), map[string]string{
 			constant.OpsRequestNameLabelKey: opsRes.OpsRequest.Name,
 		}, 1, int32(podIndexInt))

Original file line number	Diff line number	Diff line change
`@@ -231,7 +231,7 @@ func GetTemplateNameAndOrdinal(workloadName, podName string) (string, int32, err`
`231`	`231`	`templateName = podSuffix[0:lastDashIndex]`
`232`	`232`	`indexStr = podSuffix[lastDashIndex+1:]`
`233`	`233`	`}`
`234`		`- index, err := strconv.Atoi(indexStr)`
	`234`	`+ index, err := strconv.ParseInt(indexStr, 10, 32)`
`235`	`235`	`if err != nil {`
`236`	`236`	`return "", 0, fmt.Errorf("failed to obtain pod ordinal")`
`237`	`237`	`}`
Original file line number	Diff line number	Diff line change
`@@ -132,7 +132,7 @@ func listShardingCompSpecs4Test(ctx context.Context, cli client.Reader,`
`132`	`132`	`return nil, err`
`133`	`133`	`}`
`134`	`134`
`135`		`- compSpecList := make([]*appsv1.ClusterComponentSpec, 0, len(undeletedShardingComps)+len(deletingShardingComps))`
	`135`	`+ compSpecList := make([]*appsv1.ClusterComponentSpec, 0)`
`136`	`136`	`shardTpl := sharding.Template`
`137`	`137`
`138`	`138`	`processComps := func(comps []appsv1.Component) error {`
Original file line number	Diff line number	Diff line change
`@@ -107,6 +107,7 @@ func checkReconfigureUpdated(req *proto.ActionRequest) error {`
`107`	`107`	`}`
`108`	`108`
`109`	`109`	`func checkLocalFileExist(file string) (bool, error) {`
	`110`	`+ // #nosec G304`
`110`	`111`	`_, err := os.Stat(file)`
`111`	`112`	`if err != nil {`
`112`	`113`	`if os.IsNotExist(err) {`
`@@ -118,6 +119,7 @@ func checkLocalFileExist(file string) (bool, error) {`
`118`	`119`	`}`
`119`	`120`
`120`	`121`	`func checkLocalFileUpToDate(file, checksum string) error {`
	`122`	`+ // #nosec G304`
`121`	`123`	`content, err := os.ReadFile(file)`
`122`	`124`	`if err != nil {`
`123`	`125`	`return err`