Files
docker-agent/pkg/memory/database/sqlite/sqlite.go
T
David Gageot 93986be23d ci: broaden gosec coverage with targeted exclusions and inline silences
Switch gosec from a file-permission allowlist to a broader run that excludes
the systematically noisy rule families and silences the remaining legitimate
exceptions inline.

Excluded rule families (rationale in .golangci.yml):

- G101 (hardcoded credentials): false-positives on tool-name constants and
  shipped public client telemetry keys; secretsscan covers real cases.
- G104 (errors unhandled): errcheck is already enabled and matches the
  patterns we care about; gosec flags many legitimate Close-on-error-path
  callsites.
- G204 (subprocess with variable): docker-agent intentionally launches
  user-configured commands (LSP servers, hooks, agents, editors).
- G304 (file inclusion via variable): paths come from CLI flags, validated
  config, and tempdirs throughout the codebase.
- G404 (weak RNG): math/rand is used for jitter, model selection, and
  spinner animations — never for security.
- G602 (slice bounds): false-positive on dynamically-validated indices.
- G702/G703/G704 (taint analysis): paths, URLs, and commands are derived
  from validated config or user-set environment.

Real fixes uncovered by the broader run:

- pkg/mcp/server.go, pkg/server/server.go: add ReadHeaderTimeout to harden
  against Slowloris (G112).
- pkg/tui/tui.go: explicitly discard ignored Close/Remove return values via
  '_ =' (G104) — better Go style and self-documents the intent.

Inline //nolint:gosec with one-line reasons for the rules we keep enabled:

- G115 (int overflow conversions): bounded values from validated YAML
  schemas and model API constraints — frozen pre-latest config versions
  and the model providers' MaxTokens / ThinkingBudget.
- G117 (JSON 'access_token' marshaling): intentional in OAuth token storage
  and the debug command that prints (truncated) tokens.
- G118 (goroutine context detached): three deliberate fire-and-forget
  patterns — telemetry events, OTel SDK shutdown, and post-request
  StreamStoppedEvent forwarding.
- G201/G202 (SQL formatting/concatenation): rag/strategy queries embed
  internal table names; values are always bound parameters.
- G203 (template HTML auto-escape): pkg/app/export/html.go renders content
  that has already been escaped by sub-templates or is a constant SVG/CSS
  asset embedded at build time.
2026-05-09 15:41:56 +02:00

149 lines
3.9 KiB
Go

package sqlite
import (
"context"
"database/sql"
"fmt"
"strings"
"github.com/docker/docker-agent/pkg/memory/database"
"github.com/docker/docker-agent/pkg/sqliteutil"
)
type MemoryDatabase struct {
db *sql.DB
}
func NewMemoryDatabase(path string) (database.Database, error) {
db, err := sqliteutil.OpenDB(path)
if err != nil {
return nil, err
}
// Ensure we close the connection if table creation fails
// Note: We don't defer close here because we return the db on success
_, err = db.ExecContext(context.Background(), "CREATE TABLE IF NOT EXISTS memories (id TEXT PRIMARY KEY, created_at TEXT, memory TEXT)")
if err != nil {
db.Close()
return nil, err
}
// Add category column if it doesn't exist (transparent migration)
if _, err := db.ExecContext(context.Background(), "ALTER TABLE memories ADD COLUMN category TEXT DEFAULT ''"); err != nil {
if !strings.Contains(err.Error(), "duplicate column name") {
db.Close()
return nil, fmt.Errorf("memory database migration failed: %w", err)
}
}
return &MemoryDatabase{db: db}, nil
}
func (m *MemoryDatabase) AddMemory(ctx context.Context, memory database.UserMemory) error {
if memory.ID == "" {
return database.ErrEmptyID
}
_, err := m.db.ExecContext(ctx, "INSERT INTO memories (id, created_at, memory, category) VALUES (?, ?, ?, ?)",
memory.ID, memory.CreatedAt, memory.Memory, memory.Category)
return err
}
func (m *MemoryDatabase) GetMemories(ctx context.Context) ([]database.UserMemory, error) {
rows, err := m.db.QueryContext(ctx, "SELECT id, created_at, memory, COALESCE(category, '') FROM memories")
if err != nil {
return nil, err
}
defer rows.Close()
var memories []database.UserMemory
for rows.Next() {
var memory database.UserMemory
err := rows.Scan(&memory.ID, &memory.CreatedAt, &memory.Memory, &memory.Category)
if err != nil {
return nil, err
}
memories = append(memories, memory)
}
if err := rows.Err(); err != nil {
return nil, err
}
return memories, nil
}
func (m *MemoryDatabase) DeleteMemory(ctx context.Context, memory database.UserMemory) error {
_, err := m.db.ExecContext(ctx, "DELETE FROM memories WHERE id = ?", memory.ID)
return err
}
func (m *MemoryDatabase) SearchMemories(ctx context.Context, query, category string) ([]database.UserMemory, error) {
var conditions []string
var args []any
if query != "" {
words := strings.FieldsSeq(query)
for word := range words {
conditions = append(conditions, "LOWER(memory) LIKE LOWER(?) ESCAPE '\\'")
escaped := strings.ReplaceAll(word, `\`, `\\`)
escaped = strings.ReplaceAll(escaped, `%`, `\%`)
escaped = strings.ReplaceAll(escaped, `_`, `\_`)
args = append(args, "%"+escaped+"%")
}
}
if category != "" {
conditions = append(conditions, "LOWER(category) = LOWER(?)")
args = append(args, category)
}
stmt := "SELECT id, created_at, memory, COALESCE(category, '') FROM memories"
if len(conditions) > 0 {
stmt += " WHERE " + strings.Join(conditions, " AND ") //nolint:gosec // conditions are internal SQL fragments; values are bound parameters
}
rows, err := m.db.QueryContext(ctx, stmt, args...)
if err != nil {
return nil, err
}
defer rows.Close()
var memories []database.UserMemory
for rows.Next() {
var memory database.UserMemory
err := rows.Scan(&memory.ID, &memory.CreatedAt, &memory.Memory, &memory.Category)
if err != nil {
return nil, err
}
memories = append(memories, memory)
}
if err := rows.Err(); err != nil {
return nil, err
}
return memories, nil
}
func (m *MemoryDatabase) UpdateMemory(ctx context.Context, memory database.UserMemory) error {
if memory.ID == "" {
return database.ErrEmptyID
}
result, err := m.db.ExecContext(ctx, "UPDATE memories SET memory = ?, category = ? WHERE id = ?",
memory.Memory, memory.Category, memory.ID)
if err != nil {
return err
}
rows, err := result.RowsAffected()
if err != nil {
return err
}
if rows == 0 {
return fmt.Errorf("%w: %s", database.ErrMemoryNotFound, memory.ID)
}
return nil
}