newrelic / nri-flex / 26957353031

32%

Build Type

push

github

Committed by web-flow

Commit Message

fix: resolve CodeQL go/insecure-hostkeycallback in SCP (#642)

Replace ssh.InsecureIgnoreHostKey() with proper known_hosts verification.

Changes:
- Default behavior requires hosts in ~/.ssh/known_hosts
- known_hosts_file config option to specify a custom path (supports ~)
- Returns clear error with instructions if known_hosts file not found
- No filesystem side effects (doesn't create files/directories)
- No insecure fallback — genuinely enforces host key verification
- Added unit tests for getHostKeyCallback and expandHome

Resolves NR-560141.

Coverage Stats

27 of 35 new or added lines in 1 file covered. (77.14%)

14 existing lines in 1 file now uncovered.

2011 of 6384 relevant lines covered (31.5%)

9.07 hits per line