From 0e99e64ee836adc5a3c4b35a0d8148900c2e7898 Mon Sep 17 00:00:00 2001
From: Erik Dubbelboer <erik@dubbelboer.com>
Date: Sat, 26 Aug 2023 12:49:17 +0200
Subject: [PATCH] Update golangci-lint and gosec (#1609)

---
 .github/workflows/lint.yml     |  2 +-
 .github/workflows/security.yml |  2 +-
 b2s_old.go                     |  1 -
 client.go                      |  1 +
 fasthttpadaptor/b2s_new.go     | 12 ++++++++++++
 fasthttpadaptor/b2s_old.go     | 15 +++++++++++++++
 fasthttpadaptor/request.go     |  6 ------
 headers.go                     |  2 +-
 lbclient.go                    |  2 +-
 s2b_old.go                     |  2 --
 10 files changed, 32 insertions(+), 13 deletions(-)
 create mode 100644 fasthttpadaptor/b2s_new.go
 create mode 100644 fasthttpadaptor/b2s_old.go

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c73bf09b04..cb93f25906 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,5 +16,5 @@ jobs:
     - name: Run golangci-lint
       uses: golangci/golangci-lint-action@v3
       with:
-        version: v1.51.1
+        version: v1.54.2
         args: --enable=nolintlint,gochecknoinits,bodyclose,gofumpt --verbose
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index bf0b4b3faf..5c592adb6c 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -16,6 +16,6 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@v2.14.0
+        uses: securego/gosec@v2.17.0
         with:
           args: '-exclude=G104,G304,G402 ./...'
diff --git a/b2s_old.go b/b2s_old.go
index f1d3228144..6b9f799a06 100644
--- a/b2s_old.go
+++ b/b2s_old.go
@@ -11,6 +11,5 @@ import "unsafe"
 // Note it may break if string and/or slice header will change
 // in the future go versions.
 func b2s(b []byte) string {
-	/* #nosec G103 */
 	return *(*string)(unsafe.Pointer(&b))
 }
diff --git a/client.go b/client.go
index 52230316b6..ae005d72c2 100644
--- a/client.go
+++ b/client.go
@@ -581,6 +581,7 @@ func (c *Client) mCleaner(m map[string]*HostClient) {
 		c.mLock.Lock()
 		for k, v := range m {
 			v.connsLock.Lock()
+			/* #nosec G601 */
 			if v.connsCount == 0 && atomic.LoadInt32(&v.pendingClientRequests) == 0 {
 				delete(m, k)
 			}
diff --git a/fasthttpadaptor/b2s_new.go b/fasthttpadaptor/b2s_new.go
new file mode 100644
index 0000000000..09ef72acb5
--- /dev/null
+++ b/fasthttpadaptor/b2s_new.go
@@ -0,0 +1,12 @@
+//go:build go1.20
+// +build go1.20
+
+package fasthttpadaptor
+
+import "unsafe"
+
+// b2s converts byte slice to a string without memory allocation.
+// See https://groups.google.com/forum/#!msg/Golang-Nuts/ENgbUzYvCuU/90yGx7GUAgAJ .
+func b2s(b []byte) string {
+	return unsafe.String(unsafe.SliceData(b), len(b))
+}
diff --git a/fasthttpadaptor/b2s_old.go b/fasthttpadaptor/b2s_old.go
new file mode 100644
index 0000000000..08e2ac627a
--- /dev/null
+++ b/fasthttpadaptor/b2s_old.go
@@ -0,0 +1,15 @@
+//go:build !go1.20
+// +build !go1.20
+
+package fasthttpadaptor
+
+import "unsafe"
+
+// b2s converts byte slice to a string without memory allocation.
+// See https://groups.google.com/forum/#!msg/Golang-Nuts/ENgbUzYvCuU/90yGx7GUAgAJ .
+//
+// Note it may break if string and/or slice header will change
+// in the future go versions.
+func b2s(b []byte) string {
+	return *(*string)(unsafe.Pointer(&b))
+}
diff --git a/fasthttpadaptor/request.go b/fasthttpadaptor/request.go
index 827ab9242f..62a85234ae 100644
--- a/fasthttpadaptor/request.go
+++ b/fasthttpadaptor/request.go
@@ -5,7 +5,6 @@ import (
 	"io"
 	"net/http"
 	"net/url"
-	"unsafe"
 
 	"github.com/valyala/fasthttp"
 )
@@ -65,8 +64,3 @@ func ConvertRequest(ctx *fasthttp.RequestCtx, r *http.Request, forServer bool) e
 
 	return nil
 }
-
-func b2s(b []byte) string {
-	/* #nosec G103 */
-	return *(*string)(unsafe.Pointer(&b))
-}
diff --git a/headers.go b/headers.go
index 676a0da185..9d6d0a34e4 100644
--- a/headers.go
+++ b/headers.go
@@ -136,7 +136,7 @@ const (
 
 	// WebSockets
 	HeaderSecWebSocketAccept     = "Sec-WebSocket-Accept"
-	HeaderSecWebSocketExtensions = "Sec-WebSocket-Extensions"
+	HeaderSecWebSocketExtensions = "Sec-WebSocket-Extensions" /* #nosec G101 */
 	HeaderSecWebSocketKey        = "Sec-WebSocket-Key"
 	HeaderSecWebSocketProtocol   = "Sec-WebSocket-Protocol"
 	HeaderSecWebSocketVersion    = "Sec-WebSocket-Version"
diff --git a/lbclient.go b/lbclient.go
index 6be2dc9bef..7fd8a9383d 100644
--- a/lbclient.go
+++ b/lbclient.go
@@ -138,7 +138,7 @@ func (cc *LBClient) get() *lbClient {
 	minT := atomic.LoadUint64(&minC.total)
 	for _, c := range cs[1:] {
 		n := c.PendingRequests()
-		t := atomic.LoadUint64(&c.total)
+		t := atomic.LoadUint64(&c.total) /* #nosec G601 */
 		if n < minN || (n == minN && t < minT) {
 			minC = c
 			minN = n
diff --git a/s2b_old.go b/s2b_old.go
index 4cc141c424..d269cba7e5 100644
--- a/s2b_old.go
+++ b/s2b_old.go
@@ -13,9 +13,7 @@ import (
 // Note it may break if string and/or slice header will change
 // in the future go versions.
 func s2b(s string) (b []byte) {
-	/* #nosec G103 */
 	bh := (*reflect.SliceHeader)(unsafe.Pointer(&b))
-	/* #nosec G103 */
 	sh := (*reflect.StringHeader)(unsafe.Pointer(&s))
 	bh.Data = sh.Data
 	bh.Cap = sh.Len