feat(G304): add os.Root remediation hint (Autofix) when Go >= 1.24 #1386
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
What
Closes #1297
Adds an Autofix suggestion to G304 issues recommending use of os.Root for path-scoped file operations when Go version >= 1.24.
The hint appears on flagged cases (unsafe Join, unresolved path identifiers, string concatenation in paths) and is gated by Go version.
Why
os.Root (Go 1.24+) constrains file operations under a fixed root and prevents directory/symlink traversal by design.
This gives developers a modern and more robust remediation path versus ad-hoc path sanitization alone.
How
Introduces osRootSuggestion() in rules/readfile.go, checks Go version via existing gosec.GoVersion(), and attaches the suggestion via Issue.Autofix when applicable.
No change to detection logic or severity; purely an advisory hint.
Examples (suggestion appears with G304)
os.OpenFile(filepath.Join(base, userInput), ...) when not paired with filepath.Clean
Unresolved path identifiers passed to os.Open/OpenFile/ReadFile
Binary path concatenations
Compatibility
Suggestion only shown for Go >= 1.24 (some Root methods land in 1.25).
Zero behavioral changes to rule triggering; tests remain green.
Tests
go test ./rules -v: 42 passed, 0 failed.