github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-07 00:22:43 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[PR #2311] [CLOSED] Gosec #16123

New Issue
Closed
opened 2026-04-16 05:16:53 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-16 05:16:53 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/ollama/ollama/pull/2311
Author: @alpe
Created: 2/1/2024
Status: ❌ Closed

Base: main ← Head: gosec

📝 Commits (4)

  • 12f09f8 Gosec: no file limit for trusted files; minor refactoring
  • 2a21242 Gosec: no file limit for trusted files; minor refactoring
  • a0fc33a Gosec: use more restrictive file permission
  • 1bd163c Gosec: Fix G112: Potential Slowloris Attack

📊 Changes

6 files changed (+122 additions, -61 deletions)

View changed files

📝 cmd/cmd.go (+7 -2)
📝 llm/payload_common.go (+40 -54)
➕ llm/payload_common_test.go (+69 -0)
📝 server/images.go (+2 -2)
📝 server/manifests.go (+1 -1)
📝 server/routes.go (+3 -2)

📄 Description

Start fixing some gosec reports

  • more restrictive file permission for ~/.ollama files
  • add --request-header-timeout param to server to prevent slowloris DDos
  • annotate false positive in llm/payload_common.go and DRY

Please note that there are still open issues that need to be addressed or annotated with more context:

  • cmd/cmd.go:761:12: G204: Subprocess launched with a potential tainted input or cmd arguments (gosec)
  • server/upload.go:5:2: G501: Blocklisted import crypto/md5: weak cryptographic primitive (gosec)

It would be good to add gosec to the .golangci.yaml linter config and CI when all issues are addressed

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/ollama/ollama/pull/2311 **Author:** [@alpe](https://github.com/alpe) **Created:** 2/1/2024 **Status:** ❌ Closed **Base:** `main` ← **Head:** `gosec` --- ### 📝 Commits (4) - [`12f09f8`](https://github.com/ollama/ollama/commit/12f09f81b7eb8349116862d80ee4bbab216d2ba8) Gosec: no file limit for trusted files; minor refactoring - [`2a21242`](https://github.com/ollama/ollama/commit/2a212421296cef67c03557b4985abc3396e213fd) Gosec: no file limit for trusted files; minor refactoring - [`a0fc33a`](https://github.com/ollama/ollama/commit/a0fc33a369c128e2f4baa8a4a2f217c2f244b58f) Gosec: use more restrictive file permission - [`1bd163c`](https://github.com/ollama/ollama/commit/1bd163cff1396c6374c6b608bf6a0aa96a484e63) Gosec: Fix G112: Potential Slowloris Attack ### 📊 Changes **6 files changed** (+122 additions, -61 deletions) <details> <summary>View changed files</summary> 📝 `cmd/cmd.go` (+7 -2) 📝 `llm/payload_common.go` (+40 -54) ➕ `llm/payload_common_test.go` (+69 -0) 📝 `server/images.go` (+2 -2) 📝 `server/manifests.go` (+1 -1) 📝 `server/routes.go` (+3 -2) </details> ### 📄 Description Start fixing some [gosec](https://github.com/securego/gosec) reports * more restrictive file permission for ~/.ollama files * add `--request-header-timeout` param to server to prevent [slowloris](https://www.netscout.com/what-is-ddos/slowloris-attacks) DDos * annotate false positive in `llm/payload_common.go` and DRY Please note that there are still open issues that need to be addressed or annotated with more context: * `cmd/cmd.go:761:12`: G204: Subprocess launched with a potential tainted input or cmd arguments (gosec) * `server/upload.go:5:2`: G501: Blocklisted import crypto/md5: weak cryptographic primitive (gosec) It would be good to add `gosec` to the `.golangci.yaml` linter config and CI when all issues are addressed --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-16 05:16:53 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#16123
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?