newrelic / nri-flex / 26877808125

32%

master: 31%

Pull #642

github

fix: resolve CodeQL go/insecure-hostkeycallback in SCP

Replace ssh.InsecureIgnoreHostKey() with proper known_hosts verification.

Changes:
- Default behavior requires hosts in ~/.ssh/known_hosts
- known_hosts_file config option to specify a custom path (supports ~)
- Returns clear error with instructions if known_hosts file not found
- No filesystem side effects (doesn't create files/directories)
- No insecure fallback — genuinely enforces host key verification
- Added unit tests for getHostKeyCallback and expandHome

Resolves NR-560141.

27 of 35 new or added lines in 1 file covered. (77.14%)

2011 of 6384 relevant lines covered (31.5%)

9.07 hits per line