fix: update cmdutil.Reader to use os.Openfile

.github/workflows/go.yml

@@ -58,7 +58,6 @@ jobs:
       fail-fast: true
       matrix:
         go-version:
-          - "1.20.4"
           - "1.19"
           - "1.18.10"
     runs-on: ubuntu-latest

.golangci.yml

@@ -61,6 +61,75 @@ linters-settings:
   dupl:
     # tokens count to trigger issue, 150 by default
     threshold: 150
+  depguard:
+    rules:
+      main:
+        allow:
+          - $gostd
+          - filippo.io/age
+          - filippo.io/age/armor
+          - filippo.io/edwards25519
+          - github.com/MakeNowJust/heredoc/v2
+          - github.com/Masterminds/semver/v3
+          - github.com/Masterminds/sprig/v3
+          - github.com/alessio/shellescape
+          - github.com/awnumar/memguard
+          - github.com/basgys/goxml2json
+          - github.com/cloudflare/tableflip
+          - github.com/dchest/uniuri
+          - github.com/elastic
+          - github.com/fatih/color
+          - github.com/fatih/structs
+          - github.com/fernet/fernet-go
+          - github.com/go-akka/configuration
+          - github.com/go-akka/configuration
+          - github.com/go-ozzo/ozzo-validation/v4
+          - github.com/go-zookeeper/zk
+          - github.com/gobwas/glob
+          - github.com/golang/mock/mockgen/model
+          - github.com/golang/protobuf
+          - github.com/golang/snappy
+          - github.com/google/cel-go
+          - github.com/google/go-github/v42/github
+          - github.com/google/gops/agent
+          - github.com/gosimple/slug
+          - github.com/hashicorp/consul/api
+          - github.com/hashicorp/hcl
+          - github.com/hashicorp/hcl/v2
+          - github.com/hashicorp/hcl/v2/hclsimple
+          - github.com/hashicorp/hcl/v2/hclsyntax
+          - github.com/hashicorp/vault/api
+          - github.com/iancoleman/strcase
+          - github.com/imdario/mergo
+          - github.com/jmespath/go-jmespath
+          - github.com/klauspost/compress
+          - github.com/magefile/mage
+          - github.com/mcuadros/go-defaults
+          - github.com/miscreant/miscreant.go
+          - github.com/oklog/run
+          - github.com/open-policy-agent/opa/rego
+          - github.com/opencontainers/image-spec
+          - github.com/opencontainers/go-digest
+          - github.com/ory/dockertest/v3
+          - github.com/pelletier/go-toml
+          - github.com/pelletier/go-toml
+          - github.com/pierrec/lz4
+          - github.com/pkg/errors
+          - github.com/psanford/memfs
+          - github.com/sethvargo/go-diceware/diceware
+          - github.com/sethvargo/go-password/password
+          - github.com/skratchdot/open-golang/open
+          - github.com/spf13/cobra
+          - github.com/spf13/viper
+          - github.com/ulikunitz/xz
+          - github.com/xeipuuv/gojsonschema
+          - github.com/zclconf/go-cty/cty
+          - gitlab.com/NebulousLabs/merkletree
+          - oras.land/oras-go
+          - sigs.k8s.io/yaml
+          - zntr.io/paseto/v3
+          - zntr.io/paseto/v4
+
   errcheck:
     # report about not checking of errors in type assertions: `a := b.(MyStruct)`;
     # default is false: such cases aren't reported by default.
@@ -183,7 +252,7 @@ linters-settings:
 linters:
   enable:
     - bodyclose
-    - deadcode
+    # - deadcode
     - depguard
     - dogsled
     # - dupl
@@ -214,11 +283,11 @@ linters:
     - revive
     - rowserrcheck
     - staticcheck
-    - structcheck
+    # - structcheck
     - stylecheck
     - typecheck
     - unconvert
     - unparam
     - unused
-    - varcheck
+    # - varcheck
     - whitespace

pkg/sdk/cmdutil/io.go

@@ -24,7 +24,7 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path/filepath"
+	"syscall"
 	"time"
 )
 
@@ -59,9 +59,13 @@ func Reader(name string) (io.Reader, error) {
 		reader = bufio.NewReader(os.Stdin)
 		reader = NewTimeoutReader(reader, ReaderTimeout)
 	default:
-		reader, err = os.Open(filepath.Clean(name))
+		reader, err = os.OpenFile(name, syscall.O_RDONLY, 0o400)
 		if err != nil {
-			return nil, fmt.Errorf("unable to open '%s' for read: %w", name, err)
+			return nil, fmt.Errorf(
+				"failed to build reader for read operations for %s: error: %w",
+				name,
+				err,
+			)
 		}
 	}
 

pkg/template/cmdutil/values.go

@@ -23,7 +23,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path"
 	"path/filepath"
 	"strings"
 
@@ -85,8 +84,8 @@ func (opts *ValueOptions) MergeValues() (map[string]interface{}, error) {
 	// User specified a value via --set-file
 	for _, value := range opts.FileValues {
 		reader := func(rs []rune) (interface{}, error) {
-			bytes, err := os.ReadFile(string(rs))
-			return string(bytes), err
+			b, err := os.ReadFile(string(rs))
+			return string(b), err
 		}
 		if err := strvals.ParseIntoFile(value, base, reader); err != nil {
 			return nil, fmt.Errorf("failed parsing --set-file data: %w", err)
@@ -138,24 +137,23 @@ func processFilePath(currentDirectory, filePath string, result interface{}) erro
 		return fmt.Errorf("error occurred during parser instance retrieval for type '%s': %w", fileType, err)
 	}
 
-	// Change current directory if filePath is not Stdin
-	if filePath != "-" {
-		// Rebase current working dir to target file to process file inclusions
-		// Split directory and filename
-		var confDir string
-		confDir, filePath = path.Split(filePath)
-		// If confDir is not blank (current path)
-		if confDir != "" {
-			if errChDir := os.Chdir(confDir); errChDir != nil {
-				return fmt.Errorf("unable to change working directory for '%s': %w", confDir, errChDir)
-			}
-		}
+	// Drain file content
+	_, err = os.Stat(filePath)
+	if err != nil {
+		return fmt.Errorf(
+			"unable to os.Stat file name %s before attempting to build reader from current directory %s: error: %w",
+			filePath,
+			currentDirectory,
+			err,
+		)
 	}
 
-	// Drain file content
 	reader, err := cmdutil.Reader(filePath)
 	if err != nil {
-		return fmt.Errorf("unable to build a reader from '%s': %w", filePath, err)
+		return fmt.Errorf("unable to build a reader from '%s' for current directory %s: %w",
+			filePath,
+			currentDirectory,
+			err)
 	}
 
 	// Drain reader