(gosec) Apply G115 fixes to remaining internal packages

prestonvasquez · prestonvasquez · commit ac584caa004c · 2025-11-21T16:49:05.000-07:00
Address gosec G115 integer overflow warnings in:
- internal/credproviders: credential provider conversions
- internal/errutil: error code conversions
- internal/israce: build tag updates
- internal/integration: test helper conversions
- x/mongo/driver test files
diff --git a/internal/credproviders/static_provider.go b/internal/credproviders/static_provider.go
@@ -45,7 +45,7 @@ func verify(v credentials.Value) error {
 func (s *StaticProvider) Retrieve() (credentials.Value, error) {
 	if !s.verified {
 		s.err = verify(s.Value)
-		s.Value.ProviderName = staticProviderName
+		s.ProviderName = staticProviderName
 		s.verified = true
 	}
 	return s.Value, s.err
diff --git a/internal/errutil/join_go1.19.go b/internal/errutil/join_go1.19.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build !go1.20
-// +build !go1.20
 
 package errutil
 
diff --git a/internal/errutil/join_go1.20.go b/internal/errutil/join_go1.20.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build go1.20
-// +build go1.20
 
 package errutil
 
diff --git a/internal/integration/client_side_encryption_prose_test.go b/internal/integration/client_side_encryption_prose_test.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build cse
-// +build cse
 
 package integration
 
diff --git a/internal/integration/client_side_encryption_spec_test.go b/internal/integration/client_side_encryption_spec_test.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build cse
-// +build cse
 
 package integration
 
diff --git a/internal/integration/client_side_encryption_test.go b/internal/integration/client_side_encryption_test.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build cse
-// +build cse
 
 package integration
 
diff --git a/internal/integration/csot_cse_prose_test.go b/internal/integration/csot_cse_prose_test.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build cse
-// +build cse
 
 package integration
 
diff --git a/internal/integration/cursor_test.go b/internal/integration/cursor_test.go
@@ -215,10 +215,7 @@ func TestCursor_RemainingBatchLength(t *testing.T) {
 		defer cursor.Close(context.Background())
 		mt.ClearEvents()
 
-		for {
-			if cursor.TryNext(context.Background()) {
-				break
-			}
+		for !cursor.TryNext(context.Background()) {
 
 			assert.Nil(mt, cursor.Err(), "cursor error: %v", err)
 			assert.Equal(mt,
diff --git a/internal/integration/errors_test.go b/internal/integration/errors_test.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build go1.13
-// +build go1.13
 
 package integration
 
diff --git a/internal/integration/mtest/csfle_enabled.go b/internal/integration/mtest/csfle_enabled.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build cse
-// +build cse
 
 package mtest
 
diff --git a/internal/integration/mtest/csfle_not_enabled.go b/internal/integration/mtest/csfle_not_enabled.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build !cse
-// +build !cse
 
 package mtest
 
diff --git a/internal/integration/mtest/mongotest.go b/internal/integration/mtest/mongotest.go
@@ -20,6 +20,7 @@ import (
 	"go.mongodb.org/mongo-driver/v2/internal/assert"
 	"go.mongodb.org/mongo-driver/v2/internal/csfle"
 	"go.mongodb.org/mongo-driver/v2/internal/failpoint"
+	"go.mongodb.org/mongo-driver/v2/internal/mathutil"
 	"go.mongodb.org/mongo-driver/v2/internal/mongoutil"
 	"go.mongodb.org/mongo-driver/v2/internal/require"
 	"go.mongodb.org/mongo-driver/v2/mongo"
@@ -600,7 +601,7 @@ func (t *T) createTestClient() {
 	}
 
 	// Setup command monitor
-	var customMonitor = clientOpts.Monitor
+	customMonitor := clientOpts.Monitor
 	clientOpts.SetMonitor(&event.CommandMonitor{
 		Started: func(ctx context.Context, cse *event.CommandStartedEvent) {
 			if customMonitor != nil && customMonitor.Started != nil {
@@ -862,16 +863,5 @@ func (t *T) verifyConstraints() error {
 }
 
 func (t *T) interfaceToInt32(i any) (int32, error) {
-	switch conv := i.(type) {
-	case int:
-		return int32(conv), nil
-	case int32:
-		return conv, nil
-	case int64:
-		return int32(conv), nil
-	case float64:
-		return int32(conv), nil
-	}
-
-	return 0, fmt.Errorf("type %T cannot be converted to int32", i)
+	return mathutil.SafeConvertNumeric[int32](i)
 }
diff --git a/internal/integration/mtest/proxy_dialer.go b/internal/integration/mtest/proxy_dialer.go
@@ -16,6 +16,7 @@ import (
 	"time"
 
 	"go.mongodb.org/mongo-driver/v2/internal/handshake"
+	"go.mongodb.org/mongo-driver/v2/internal/mathutil"
 	"go.mongodb.org/mongo-driver/v2/mongo/options"
 	"go.mongodb.org/mongo-driver/v2/x/bsonx/bsoncore"
 )
@@ -168,7 +169,13 @@ func (pc *proxyConn) Read(buffer []byte) (int, error) {
 	// buffer to the end of a four-byte slice and using UpdateLength to set the length bytes.
 	idx, wm := bsoncore.ReserveLength(nil)
 	wm = append(wm, buffer...)
-	wm = bsoncore.UpdateLength(wm, idx, int32(len(wm[idx:])))
+
+	wmLen, err := mathutil.SafeConvertNumeric[int32](len(wm))
+	if err != nil {
+		return 0, fmt.Errorf("wire message size %d exceeds maximum int32 size: %w", len(wm), err)
+	}
+
+	wm = bsoncore.UpdateLength(wm, idx, wmLen)
 
 	if err := pc.dialer.storeReceivedMessage(wm, pc.RemoteAddr().String()); err != nil {
 		wrapped := fmt.Errorf("error storing received message: %w", err)
diff --git a/internal/integration/sdam_error_handling_test.go b/internal/integration/sdam_error_handling_test.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build go1.13
-// +build go1.13
 
 package integration
 
diff --git a/internal/integration/unified_spec_test.go b/internal/integration/unified_spec_test.go
@@ -69,15 +69,15 @@ func decodeTestData(dc bson.DecodeContext, vr bson.ValueReader, val reflect.Valu
 	switch vr.Type() {
 	case bson.TypeArray:
 		docsVal := val.FieldByName("Documents")
-		decoder, err := dc.Registry.LookupDecoder(docsVal.Type())
+		decoder, err := dc.LookupDecoder(docsVal.Type())
 		if err != nil {
 			return err
 		}
 
 		return decoder.DecodeValue(dc, vr, docsVal)
 	case bson.TypeEmbeddedDocument:
 		gridfsDataVal := val.FieldByName("GridFSData")
-		decoder, err := dc.Registry.LookupDecoder(gridfsDataVal.Type())
+		decoder, err := dc.LookupDecoder(gridfsDataVal.Type())
 		if err != nil {
 			return err
 		}
diff --git a/internal/israce/norace.go b/internal/israce/norace.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build !race
-// +build !race
 
 // Package israce reports if the Go race detector is enabled.
 package israce
diff --git a/internal/israce/race.go b/internal/israce/race.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build race
-// +build race
 
 // Package israce reports if the Go race detector is enabled.
 package israce
diff --git a/x/mongo/driver/connstring/connstring_spec_test.go b/x/mongo/driver/connstring/connstring_spec_test.go
@@ -112,7 +112,7 @@ func runTest(t *testing.T, test testCase, warningsError bool) {
 	// URI options, but don't with some of the older things, we do a switch on the filename
 	// here. We are trying to not break existing user applications that have unrecognized
 	// options.
-	if test.Valid && !(test.Warning && warningsError) {
+	if test.Valid && (!test.Warning || !warningsError) {
 		require.NoError(t, err)
 	} else {
 		require.Error(t, err)
diff --git a/x/mongo/driver/drivertest/channel_conn.go b/x/mongo/driver/drivertest/channel_conn.go
@@ -10,6 +10,7 @@ import (
 	"context"
 	"errors"
 
+	"go.mongodb.org/mongo-driver/v2/internal/mathutil"
 	"go.mongodb.org/mongo-driver/v2/mongo/address"
 	"go.mongodb.org/mongo-driver/v2/x/bsonx/bsoncore"
 	"go.mongodb.org/mongo-driver/v2/x/mongo/driver/description"
@@ -105,7 +106,13 @@ func MakeReply(doc bsoncore.Document) []byte {
 	dst = wiremessage.AppendReplyStartingFrom(dst, 0)
 	dst = wiremessage.AppendReplyNumberReturned(dst, 1)
 	dst = append(dst, doc...)
-	return bsoncore.UpdateLength(dst, idx, int32(len(dst[idx:])))
+
+	wmLen, err := mathutil.SafeConvertNumeric[int32](len(dst[idx:]))
+	if err != nil {
+		panic("reply size exceeds int32")
+	}
+
+	return bsoncore.UpdateLength(dst, idx, wmLen)
 }
 
 // GetCommandFromQueryWireMessage returns the command sent in an OP_QUERY wire message.
diff --git a/x/mongo/driver/drivertest/opmsg_deployment.go b/x/mongo/driver/drivertest/opmsg_deployment.go
@@ -9,11 +9,13 @@ package drivertest
 import (
 	"context"
 	"errors"
+	"fmt"
 	"time"
 
 	"go.mongodb.org/mongo-driver/v2/bson"
 	"go.mongodb.org/mongo-driver/v2/internal/csot"
 	"go.mongodb.org/mongo-driver/v2/internal/driverutil"
+	"go.mongodb.org/mongo-driver/v2/internal/mathutil"
 	"go.mongodb.org/mongo-driver/v2/mongo/address"
 	"go.mongodb.org/mongo-driver/v2/x/bsonx/bsoncore"
 	"go.mongodb.org/mongo-driver/v2/x/mongo/driver"
@@ -56,8 +58,10 @@ type connection struct {
 	responses []bson.D // responses to send when ReadWireMessage is called
 }
 
-var _ mnet.ReadWriteCloser = &connection{}
-var _ mnet.Describer = &connection{}
+var (
+	_ mnet.ReadWriteCloser = &connection{}
+	_ mnet.Describer       = &connection{}
+)
 
 // Write is a no-op.
 func (c *connection) Write(context.Context, []byte) error {
@@ -86,7 +90,13 @@ func (c *connection) Read(_ context.Context) ([]byte, error) {
 	dst = wiremessage.AppendMsgSectionType(dst, wiremessage.SingleDocument)
 	resBytes, _ := bson.Marshal(nextRes)
 	dst = append(dst, resBytes...)
-	dst = bsoncore.UpdateLength(dst, wmindex, int32(len(dst[wmindex:])))
+
+	wmLen, err := mathutil.SafeConvertNumeric[int32](len(dst[wmindex:]))
+	if err != nil {
+		return nil, fmt.Errorf("response size %d exceeds int32: %w", len(dst[wmindex:]), err)
+	}
+
+	dst = bsoncore.UpdateLength(dst, wmindex, wmLen)
 	return dst, nil
 }
 
@@ -132,11 +142,13 @@ type MockDeployment struct {
 	updates chan description.Topology
 }
 
-var _ driver.Deployment = &MockDeployment{}
-var _ driver.Server = &MockDeployment{}
-var _ driver.Connector = &MockDeployment{}
-var _ driver.Disconnector = &MockDeployment{}
-var _ driver.Subscriber = &MockDeployment{}
+var (
+	_ driver.Deployment   = &MockDeployment{}
+	_ driver.Server       = &MockDeployment{}
+	_ driver.Connector    = &MockDeployment{}
+	_ driver.Disconnector = &MockDeployment{}
+	_ driver.Subscriber   = &MockDeployment{}
+)
 
 // SelectServer implements the Deployment interface. This method does not use the
 // description.SelectedServer provided and instead returns itself. The Connections returned from the
diff --git a/x/mongo/driver/integration/main_test.go b/x/mongo/driver/integration/main_test.go
@@ -133,7 +133,7 @@ func dropCollection(t *testing.T, dbname, colname string) {
 	err := operation.NewCommand(bsoncore.BuildDocument(nil, bsoncore.AppendStringElement(nil, "drop", colname))).
 		Database(dbname).ServerSelector(&serverselector.Write{}).Deployment(integtest.Topology(t)).
 		Execute(context.Background())
-	if de, ok := err.(driver.Error); err != nil && !(ok && de.NamespaceNotFound()) {
+	if de, ok := err.(driver.Error); err != nil && (!ok || !de.NamespaceNotFound()) {
 		require.NoError(t, err)
 	}
 }
diff --git a/x/mongo/driver/ocsp/ocsp_test.go b/x/mongo/driver/ocsp/ocsp_test.go
@@ -5,7 +5,6 @@
 // a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 
 //go:build go1.13
-// +build go1.13
 
 package ocsp
 

Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,7 @@ func verify(v credentials.Value) error {`
`45`	`45`	`func (s *StaticProvider) Retrieve() (credentials.Value, error) {`
`46`	`46`	`if !s.verified {`
`47`	`47`	`s.err = verify(s.Value)`
`48`		`- s.Value.ProviderName = staticProviderName`
	`48`	`+ s.ProviderName = staticProviderName`
`49`	`49`	`s.verified = true`
`50`	`50`	`}`
`51`	`51`	`return s.Value, s.err`