gosec ignores excludes section in golangci.yml

[dimshush]

Hello everybody

Ran this in project directory:
golangci-lint run -c ./.golangci.yml --out-format code-climate | tee code-quality-report.json | jq -r '.[] | "\(.location.path):\(.location.lines.begin) \(.description)"'

and got gosec errors which are in "linters-settings: excludes" section for gosec in .golangci.yml (G404, G501, etc)

Tried type G errors with quotes like "G404" - no sense

Errors disapears from output only if i pointed them in exclude-rules: section like this

- linters:
     - gosec
   text: "G[104,401,404,501,505]"

But i wanna dont just filter output but disable checking for this issues.
Im rly confused about it

PS: attached golangci.yml in md format. Unfortunately i cant show you linted code for more convinience
golangci.md

[ldez]

Hello,

The content of the field text is a regular expression, then G[104,401,404,501,505] means the letter G followed by one character in the group 104,401,404,501,505 (ie: 0145,)

https://regex101.com/r/SkTivv/1

The right expression is G(104|401|404|501|505)

https://regex101.com/r/U2Kerh/1

Also enable or disable a rule for gosec, you can do it in the gosec dedicated section: https://golangci-lint.run/usage/linters/#gosec

[dimshush]

Thx for advice about regexp

Also enable or disable a rule for gosec, you can do it in the gosec dedicated section: https://golangci-lint.run/usage/linters/#gosec

I suppose you didnt open file i attached.
That is a problem I wrote about - I did what you are suggesting and got no effect

 gosec:
    excludes:
      - G104
      - G401
      - G404
      - G501
      - G505

[ldez]

I read your configuration, but everything works as expected with golangci-ling v1.40.1:

main.go

package main

import "crypto/md5"

func main() {
	md5.New()
}

golangci-lint.yml

linters-settings:
#  gosec:
#    excludes:
#      - G104
#      - G401
#      - G404
#      - G501
#      - G505

linters:
  disable-all: true
  enable:
    - gosec

issues:
  exclude-use-default: false
  max-issues-per-linter: 0
  max-same-issues: 0

$ golangci-lint run
main.go:3:8: G501: Blocklisted import crypto/md5: weak cryptographic primitive (gosec)
import "crypto/md5"
       ^
main.go:6:2: G401: Use of weak cryptographic primitive (gosec)
        md5.New()
        ^

golangci-lint.yml

linters-settings:
  gosec:
    excludes:
      - G104
      - G401
      - G404
      - G501
      - G505

linters:
  disable-all: true
  enable:
    - gosec

issues:
  exclude-use-default: false
  max-issues-per-linter: 0
  max-same-issues: 0

$ golangci-lint run
# nothing

[dimshush]

Hm... It`s confusing me more than earlier ))
Thx for your time, fellow