newrelic / nri-flex / 26756226152

32%

master: 31%

Build Type

Pull #642

github

Committed by ujwalsah

Commit Message

fix: resolve CodeQL go/insecure-hostkeycallback in SCP

Replace ssh.InsecureIgnoreHostKey() with proper known_hosts verification.

Changes:
- Default behavior requires hosts in ~/.ssh/known_hosts
- known_hosts_file: specify a custom path (supports ~ expansion)
- skip_host_key_verification: explicit opt-in for insecure behavior
  (logs warning once via sync.Once, uses custom callback to avoid
  triggering CodeQL on ssh.InsecureIgnoreHostKey)
- Returns clear error with instructions if known_hosts file not found
- No filesystem side effects (doesn't create files/directories)
- Added unit tests for getHostKeyCallback and expandHome

Resolves NR-560141.

Pull Request Pull Request #642: fix: resolve CodeQL go/insecure-hostkeycallback in SCP

Coverage Stats

36 of 47 new or added lines in 1 file covered. (76.6%)

13 existing lines in 1 file now uncovered.

2020 of 6395 relevant lines covered (31.59%)

9.06 hits per line