G706 triggers on slog.Warn/slog.Error

[dsonck92]

When we updated to the latest version of golangci-lint, and thus received an updated gosec linter, we discovered a lot of flagged log lines. Reading CWE-117, the risk seems to be forging log lines to confuse other systems or humans when reading them.

We use slog for our logging purposes which escapes these values already. So newlines and quotation will be properly escaped and prevent issues with inserting additional log lines or marking more structured logging fields.

Are there any other risks that could be present, or could this be considered a false positive? Example log lines:

pkg/api/handler.go:89:13: G706: Log injection via taint analysis (gosec)
                slog.Error("request failed", "err", err, "uri", req.RequestURI)

pkg/api/handler.go:103:12: G706: Log injection via taint analysis (gosec)
                slog.Warn("Error getting FS to serve", "err", err, "ext", fileExtension, "path", r.URL.Path)

pkg/api/handler.go:144:12: G706: Log injection via taint analysis (gosec)
                slog.Warn("Error getting HLS file info", "err", err, "path", filePath) // Filepath is derived from r.URL.Path

[ravisastryk]

Hi @dsonck92, thanks for the detailed report and the clear examples. This is a false positive.

The G706 slog sinks were registered without a CheckArgs restriction, so the taint engine checked all arguments including the structured key-value attribute pairs. Since slog.Warn/Error/Info/Debug have the signature func(msg string, args ...any), any tainted value passed as an attribute (e.g. "uri", req.RequestURI) would trigger the rule, even though both TextHandler and JSONHandler automatically escape attribute values.

The fix would be to add CheckArgs: []int{0} to all four log/slog sinks, scoping the taint check to the msg argument only - the one place where TextHandler does write verbatim without escaping. Tainted message arguments (e.g. slog.Warn(userInput)) will still be flagged correctly.

This follows the same pattern already used for SQL injection sinks (CheckArgs: []int{1} to skip the receiver) and SMTP injection sinks.