Add nosec exclusions

Author: hslatman

command/oauth/cmd.go

@@ -526,7 +526,7 @@ func oauthCmd(c *cli.Context) error {
 				fmt.Println(tok.AccessToken)
 			}
 		} else {
-			b, err := json.MarshalIndent(tok, "", "  ")
+			b, err := json.MarshalIndent(tok, "", "  ") // #nosec G117 --  printing the token details intentionally
 			if err != nil {
 				return errors.Wrapf(err, "error marshaling token data")
 			}
@@ -1318,7 +1318,7 @@ func (o *oauth) badRequest(w http.ResponseWriter, msg string) {
 	w.Write([]byte(`</div>`))
 	w.Write([]byte(`<p style='font-size: 20px;'>`))
 	w.Write([]byte(`<strong style='font-size: 28px; color: red;'>Failure</strong><br />`))
-	w.Write([]byte(msg))
+	w.Write([]byte(msg)) // #nosec G705 -- message is either a string literal, or comes from (trusted) IdP
 	w.Write([]byte(`</p></body></html>`))
 	o.errCh <- errors.New(msg)
 }

utils/cautils/tpm.go

@@ -649,7 +649,7 @@ func (ac *attestationClient) verifyDecryptedSecret(ctx context.Context, secret [
 		DecryptedSecret: secret,
 	}
 
-	body, err := json.Marshal(sr)
+	body, err := json.Marshal(sr) // #nosec G117 -- the decrypted secret is intentionally sent back to attestation CA (via HTTPS)
 	if err != nil {
 		return nil, fmt.Errorf("failed marshaling secret request: %w", err)
 	}