mirror of
https://github.com/docker/docker-agent.git
synced 2026-11-06 15:07:58 +00:00
Switch gosec from a file-permission allowlist to a broader run that excludes the systematically noisy rule families and silences the remaining legitimate exceptions inline. Excluded rule families (rationale in .golangci.yml): - G101 (hardcoded credentials): false-positives on tool-name constants and shipped public client telemetry keys; secretsscan covers real cases. - G104 (errors unhandled): errcheck is already enabled and matches the patterns we care about; gosec flags many legitimate Close-on-error-path callsites. - G204 (subprocess with variable): docker-agent intentionally launches user-configured commands (LSP servers, hooks, agents, editors). - G304 (file inclusion via variable): paths come from CLI flags, validated config, and tempdirs throughout the codebase. - G404 (weak RNG): math/rand is used for jitter, model selection, and spinner animations — never for security. - G602 (slice bounds): false-positive on dynamically-validated indices. - G702/G703/G704 (taint analysis): paths, URLs, and commands are derived from validated config or user-set environment. Real fixes uncovered by the broader run: - pkg/mcp/server.go, pkg/server/server.go: add ReadHeaderTimeout to harden against Slowloris (G112). - pkg/tui/tui.go: explicitly discard ignored Close/Remove return values via '_ =' (G104) — better Go style and self-documents the intent. Inline //nolint:gosec with one-line reasons for the rules we keep enabled: - G115 (int overflow conversions): bounded values from validated YAML schemas and model API constraints — frozen pre-latest config versions and the model providers' MaxTokens / ThinkingBudget. - G117 (JSON 'access_token' marshaling): intentional in OAuth token storage and the debug command that prints (truncated) tokens. - G118 (goroutine context detached): three deliberate fire-and-forget patterns — telemetry events, OTel SDK shutdown, and post-request StreamStoppedEvent forwarding. - G201/G202 (SQL formatting/concatenation): rag/strategy queries embed internal table names; values are always bound parameters. - G203 (template HTML auto-escape): pkg/app/export/html.go renders content that has already been escaped by sub-templates or is a constant SVG/CSS asset embedded at build time.
149 lines
3.9 KiB
Go
149 lines
3.9 KiB
Go
package sqlite
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/docker/docker-agent/pkg/memory/database"
|
|
"github.com/docker/docker-agent/pkg/sqliteutil"
|
|
)
|
|
|
|
type MemoryDatabase struct {
|
|
db *sql.DB
|
|
}
|
|
|
|
func NewMemoryDatabase(path string) (database.Database, error) {
|
|
db, err := sqliteutil.OpenDB(path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
// Ensure we close the connection if table creation fails
|
|
// Note: We don't defer close here because we return the db on success
|
|
|
|
_, err = db.ExecContext(context.Background(), "CREATE TABLE IF NOT EXISTS memories (id TEXT PRIMARY KEY, created_at TEXT, memory TEXT)")
|
|
if err != nil {
|
|
db.Close()
|
|
return nil, err
|
|
}
|
|
|
|
// Add category column if it doesn't exist (transparent migration)
|
|
if _, err := db.ExecContext(context.Background(), "ALTER TABLE memories ADD COLUMN category TEXT DEFAULT ''"); err != nil {
|
|
if !strings.Contains(err.Error(), "duplicate column name") {
|
|
db.Close()
|
|
return nil, fmt.Errorf("memory database migration failed: %w", err)
|
|
}
|
|
}
|
|
|
|
return &MemoryDatabase{db: db}, nil
|
|
}
|
|
|
|
func (m *MemoryDatabase) AddMemory(ctx context.Context, memory database.UserMemory) error {
|
|
if memory.ID == "" {
|
|
return database.ErrEmptyID
|
|
}
|
|
_, err := m.db.ExecContext(ctx, "INSERT INTO memories (id, created_at, memory, category) VALUES (?, ?, ?, ?)",
|
|
memory.ID, memory.CreatedAt, memory.Memory, memory.Category)
|
|
return err
|
|
}
|
|
|
|
func (m *MemoryDatabase) GetMemories(ctx context.Context) ([]database.UserMemory, error) {
|
|
rows, err := m.db.QueryContext(ctx, "SELECT id, created_at, memory, COALESCE(category, '') FROM memories")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
|
|
var memories []database.UserMemory
|
|
for rows.Next() {
|
|
var memory database.UserMemory
|
|
err := rows.Scan(&memory.ID, &memory.CreatedAt, &memory.Memory, &memory.Category)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
memories = append(memories, memory)
|
|
}
|
|
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return memories, nil
|
|
}
|
|
|
|
func (m *MemoryDatabase) DeleteMemory(ctx context.Context, memory database.UserMemory) error {
|
|
_, err := m.db.ExecContext(ctx, "DELETE FROM memories WHERE id = ?", memory.ID)
|
|
return err
|
|
}
|
|
|
|
func (m *MemoryDatabase) SearchMemories(ctx context.Context, query, category string) ([]database.UserMemory, error) {
|
|
var conditions []string
|
|
var args []any
|
|
|
|
if query != "" {
|
|
words := strings.FieldsSeq(query)
|
|
for word := range words {
|
|
conditions = append(conditions, "LOWER(memory) LIKE LOWER(?) ESCAPE '\\'")
|
|
escaped := strings.ReplaceAll(word, `\`, `\\`)
|
|
escaped = strings.ReplaceAll(escaped, `%`, `\%`)
|
|
escaped = strings.ReplaceAll(escaped, `_`, `\_`)
|
|
args = append(args, "%"+escaped+"%")
|
|
}
|
|
}
|
|
|
|
if category != "" {
|
|
conditions = append(conditions, "LOWER(category) = LOWER(?)")
|
|
args = append(args, category)
|
|
}
|
|
|
|
stmt := "SELECT id, created_at, memory, COALESCE(category, '') FROM memories"
|
|
if len(conditions) > 0 {
|
|
stmt += " WHERE " + strings.Join(conditions, " AND ") //nolint:gosec // conditions are internal SQL fragments; values are bound parameters
|
|
}
|
|
|
|
rows, err := m.db.QueryContext(ctx, stmt, args...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
|
|
var memories []database.UserMemory
|
|
for rows.Next() {
|
|
var memory database.UserMemory
|
|
err := rows.Scan(&memory.ID, &memory.CreatedAt, &memory.Memory, &memory.Category)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
memories = append(memories, memory)
|
|
}
|
|
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return memories, nil
|
|
}
|
|
|
|
func (m *MemoryDatabase) UpdateMemory(ctx context.Context, memory database.UserMemory) error {
|
|
if memory.ID == "" {
|
|
return database.ErrEmptyID
|
|
}
|
|
|
|
result, err := m.db.ExecContext(ctx, "UPDATE memories SET memory = ?, category = ? WHERE id = ?",
|
|
memory.Memory, memory.Category, memory.ID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
rows, err := result.RowsAffected()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if rows == 0 {
|
|
return fmt.Errorf("%w: %s", database.ErrMemoryNotFound, memory.ID)
|
|
}
|
|
|
|
return nil
|
|
}
|