newrelic / nri-flex

32%

master: 31%

LAST BUILD ON BRANCH fix/codeql-insecure-hostkeycallback

branch: fix/codeql-insecure-hostkeycallback

CHANGE BRANCH

x

Reset

Sync Branches

• fix/codeql-insecure-hostkeycallback
• 20231102_bump_vulnerable_packages
• 20231102_use_bash_instead_of_pwshell_in_ghrunner_TEST
• NEWRELIC-6016
• NR-100933-bump_to_go_1_20
• NR-107454_close_db_connections
• NR-124592_add_renovate
• NR-219553_add_sdk_temp_dir
• NR-291019-build-fips-compliant-nri-flex
• NR-337684-add-patch-to-go-version
• NR-466767-added-security-workflow
• NR-495830
• NR-50701/fix_net_cve
• NR-58927-fix-CVE-2022-32149
• NR_526827_Security_Workflow
• add_e2e_examples
• add_e2e_tests
• add_safe_repository
• async_rate_bug
• broken-pipeline-fix
• bump-go-version
• bump_docker
• bump_docker_dependency
• cciutea/deps_fix
• cciutea/fix_deps
• cciutea/revert_pr_429
• cciutea/update_deps
• change_synk_var
• chore(deps)-golang-version-upgrade
• chore/NR-129272-bump-go-patch-version
• chore/circl-v1-3-7
• chore/go-1-21
• ci/disable-cgo-for-tests
• ci/pre-release
• ci/use-goreleaser-github-action
• covdata
• covdatafix1
• croman/update-integration-tests
• deleteme
• dependabot/go_modules/github.com/cloudflare/circl-1.3.7
• dependabot/go_modules/github.com/docker/docker-23.0.8incompatible
• dependabot/go_modules/github.com/docker/docker-24.0.9incompatible
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.40.0
• dependabot/go_modules/golang.org/x/crypto-0.17.0
• dependabot/go_modules/google.golang.org/protobuf-1.33.0
• doc/added_errors_info
• docs/update-troubleshooting-guide-new-path
• feat-deprecate-legacy-attr
• feature/NR-100933-bump-to-go-1-20
• feature/NR-109516-downgrade-to-go-1-19-8
• fix-coveralls
• fix-env-substitution-NR-378220
• fix-fips-pkg-naming-format
• fix-race-condition-db-async-queries
• fix/add-security-events-permission
• fix/add-workflow-permissions
• fix/bump_x_net
• fix/codeql-clear-text-logging
• fix/codeql-weak-hashing
• fix/codeql-weak-hashing-v2
• fix/cve-2020-29652
• fix/disable-cgo-with-templates
• fix/dockerfile-packages
• fix/go-1.25.10
• fix/grpc-vuln-upgrade
• fix/otel-sdk-vuln-upgrade
• fix/security-deps-upgrade
• fix/update_dependencies
• fix/upgrade-otel-v1.43.0
• fix_assert_command
• fix_docker_cve
• fix_parsing_error
• fix_prometheus_common_dep
• fix_vulns
• fix_vulns_2
• fix_windows
• fix_windows_runner_version
• gaurab/bump-docker
• go-version-update
• go-version-update-1.25.8
• gsanchez/chore/bump-go-1-21
• gsanchez/deps/bump-protobuf
• hren/aliyun
• hren/html_parse
• hren/netdial_fix
• ignore_output_and_filters
• issue-659-update-mssql-driver
• issue-templates
• issue-templates-updates
• kav/SQLite
• kav/ValueToUpperLower
• kav/certKeySupport
• kav/fixCommandLogging
• kav/fixJqResults
• kav/handleInf
• kav/logOutput
• kav/updateVertica
• master
• patch-1
• pk/dependancy-bot-opentelemetry-bump
• refs/tags/v.1.4.4
• refs/tags/v1.10.0
• refs/tags/v1.11.0
• refs/tags/v1.12.0
• refs/tags/v1.13.0
• refs/tags/v1.14.0
• refs/tags/v1.15.0
• refs/tags/v1.15.1
• refs/tags/v1.15.2
• refs/tags/v1.4.0
• refs/tags/v1.4.1
• refs/tags/v1.4.2
• refs/tags/v1.4.3
• refs/tags/v1.4.4
• refs/tags/v1.4.5
• refs/tags/v1.5.0
• refs/tags/v1.5.1
• refs/tags/v1.5.2
• refs/tags/v1.5.3
• refs/tags/v1.5.4
• refs/tags/v1.6.0
• refs/tags/v1.6.1
• refs/tags/v1.7.0
• refs/tags/v1.7.1
• refs/tags/v1.7.2
• refs/tags/v1.8.0
• refs/tags/v1.8.1
• refs/tags/v1.8.2
• refs/tags/v1.8.3
• refs/tags/v1.8.4
• refs/tags/v1.8.5
• refs/tags/v1.8.6
• refs/tags/v1.9.0
• refs/tags/v1.9.1
• refs/tags/v1.9.2
• refs/tags/v1.9.3
• refs/tags/v1.9.4
• refs/tags/v9.9.8
• refs/tags/v9.9.9
• renovate/actions-checkout-4.x
• renovate/actions-checkout-5.x
• renovate/actions-checkout-6.x
• renovate/actions-checkout-7.x
• renovate/actions-github-script-7.x
• renovate/actions-github-script-8.x
• renovate/actions-github-script-9.x
• renovate/actions-setup-go-5.x
• renovate/actions-setup-go-6.x
• renovate/aws-sdk-go-monorepo
• renovate/aws-sdk-go-v2-monorepo
• renovate/docker-login-action-3.x
• renovate/docker-login-action-4.x
• renovate/github.com-aleksi-gocov-xml-1.x
• renovate/github.com-aws-aws-lambda-go-1.x
• renovate/github.com-axw-gocov-1.x
• renovate/github.com-docker-docker-23.x
• renovate/github.com-docker-docker-25.x
• renovate/github.com-docker-docker-27.x
• renovate/github.com-docker-docker-28.x
• renovate/github.com-go-git-go-git-v5-5.x
• renovate/github.com-go-sql-driver-mysql-1.x
• renovate/github.com-itchyny-gojq-0.x
• renovate/github.com-jandelgado-gcov2lcov-1.x
• renovate/github.com-lib-pq-1.x
• renovate/github.com-moby-moby-api-1.x
• renovate/github.com-moby-moby-client-0.x
• renovate/github.com-monetdb-monetdb-go-1.x
• renovate/github.com-monetdb-monetdb-go-2.x
• renovate/github.com-newrelic-experimental-go-ase-1.x
• renovate/github.com-parnurzeal-gorequest-0.x
• renovate/github.com-pkg-sftp-1.x
• renovate/github.com-prometheus-client_model-0.x
• renovate/github.com-prometheus-common-0.x
• renovate/github.com-sap-go-hdb-0.x
• renovate/github.com-sap-go-hdb-1.x
• renovate/github.com-shirou-gopsutil-v3-3.x
• renovate/github.com-shirou-gopsutil-v3-4.x
• renovate/github.com-sijms-go-ora-v2-2.x
• renovate/github.com-sirupsen-logrus-1.x
• renovate/github.com-spf13-afero-1.x
• renovate/github.com-stretchr-testify-1.x
• renovate/github.com-vertica-vertica-sql-go-1.x
• renovate/go-github.com-go-git-go-git-v5-vulnerability
• renovate/go-github.com/docker/docker-vulnerability
• renovate/go-golang.org-x-crypto-vulnerability
• renovate/go-golang.org-x-net-vulnerability
• renovate/go.uber.org-ratelimit-0.x
• renovate/golang-patch-version
• renovate/golang-version
• renovate/golang.org-x-crypto-0.x
• renovate/golang.org-x-net-0.x
• renovate/gopkg.in-yaml.v2-3.x
• renovate/postgres-11.x
• renovate/postgres-16.x
• renovate/postgres-17.x
• renovate/postgres-18.x
• renovate/ubuntu
• renovate/ubuntu-22.x
• renovate/ubuntu-24.x
• security/bump-vulnerable-dependencies
• test_license_ignore
• test_on_pr
• update-to-aws-sdk-v2
• update_docs_contrib
• update_go_119
• update_go_version
• update_go_version_1.21
• update_hdb_version
• update_protobuf_vul
• upgrade-docker-api-deps
• v1.16.0
• v1.16.1
• v1.16.2
• v1.16.3
• v1.16.4
• v1.16.5
• v1.16.6
• v1.16.7
• v1.17.0
• v1.17.1
• v1.17.2
• v1.17.3
• v1.17.4
• v1.17.5
• v1.17.6
• v1.17.7
• v1.18.0
• v1.18.1
• v1.18.2
• v1.18.3
• v1.18.4
• v1.18.5
• v1.18.6
• v1.18.7
• v1.18.8
• v1.18.9

Build # 26877808125

Build Type

Pull #642

github

Committed by ujwalsah

Commit Message

fix: resolve CodeQL go/insecure-hostkeycallback in SCP

Replace ssh.InsecureIgnoreHostKey() with proper known_hosts verification.

Changes:
- Default behavior requires hosts in ~/.ssh/known_hosts
- known_hosts_file config option to specify a custom path (supports ~)
- Returns clear error with instructions if known_hosts file not found
- No filesystem side effects (doesn't create files/directories)
- No insecure fallback — genuinely enforces host key verification
- Added unit tests for getHostKeyCallback and expandHome

Resolves NR-560141.

Pull Request Pull Request #642: fix: resolve CodeQL go/insecure-hostkeycallback in SCP

Coverage Stats

27 of 35 new or added lines in 1 file covered. (77.14%)

2011 of 6384 relevant lines covered (31.5%)

9.07 hits per line