XR008

ResourcesExtra · tfsproutxFixable with -fix

check for os/exec.CommandContext usage

The XR008 analyzer reports usage of the os/exec.CommandContext() function. Providers that are using Go language based SDKs likely want to prevent any execution of other binaries for various reasons such as security and unexpected requirements (e.g. tool installation outside Terraform).

Examples

var sneaky = exec.CommandContext

sneaky("evilprogram")

exec.CommandContext("evilprogram")

// Not present :)

Ignoring reports

Singular reports can be ignored by adding a //lintignore:XR008 Go code comment at the end of the offending line or on the line immediately preceding, e.g.

//lintignore:XR008
exec.CommandContext("evilprogram")

This page is generated from xpasses/XR008/README.md, which lives beside the analyzer.