[BUG][GO] Go client code doesn't pass gosec

Bug Report Checklist

• Have you provided a full/minimal spec to reproduce the issue?
• Have you validated the input using an OpenAPI validator (example)?
• Have you tested with the latest master to confirm the issue still exists?
• Have you searched for related issues/PRs?
• What's the actual output vs expected output?

Description

The Go generated client code doesn't pass a gosec check.

openapi-generator version

Version: 5.3.1

OpenAPI declaration file content or url

See deceleration bellow (note the yaml spec imports the json)
myservice.spec.yaml:

openapi: 3.0.1
info:
  version: 1.0.0
  title: Example key value
paths:
  /getKey:
    post:
      requestBody:
        description: Get Key Request Object
        required: true
        content:
          application/json:
            schema:
              $ref: "service_spec.json#/definitions/GetRequest"
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: "service_spec.json#/definitions/GetResponse"

service_spec.json:

{
  "title": "d.json",
  "definitions": {
    "GetRequest": {
      "type": "object",
      "description": "Get the value of a key",
      "properties": {
        "key": {
          "description": "The key",
          "type": "string"
        }
      },
      "required": [
        "key"
      ]
    },
    "GetResponse": {
      "type": "object",
      "required": [
        "value"
      ],
      "properties": {
        "value": {
          "description": "The value",
          "type": "string"
        }
      }
    }
  }
}

Generation Details

Nothing particular, just run the generator using the service declaration, see steps to reproduce.

Steps to reproduce

openapi-generator generate -i myservice.spec.yaml -g go -o out
cd out
go mod download
gosec ./...

Output vs expected output

Output

tomersol@tomersol-Virtual-Machine:~/experiments/out$ gosec ./...
[gosec] 2022/01/05 17:53:19 Including rules: default
[gosec] 2022/01/05 17:53:19 Excluding rules: default
[gosec] 2022/01/05 17:53:19 Import directory: /home/tomersol/experiments/out
[gosec] 2022/01/05 17:53:19 Checking package: openapi
[gosec] 2022/01/05 17:53:19 Checking file: /home/tomersol/experiments/out/api_default.go
[gosec] 2022/01/05 17:53:19 Checking file: /home/tomersol/experiments/out/client.go
[gosec] 2022/01/05 17:53:19 Checking file: /home/tomersol/experiments/out/configuration.go
[gosec] 2022/01/05 17:53:19 Checking file: /home/tomersol/experiments/out/model_get_request.go
[gosec] 2022/01/05 17:53:19 Checking file: /home/tomersol/experiments/out/model_get_response.go
[gosec] 2022/01/05 17:53:19 Checking file: /home/tomersol/experiments/out/response.go
[gosec] 2022/01/05 17:53:19 Checking file: /home/tomersol/experiments/out/utils.go
Results:

Golang errors in file: [/home/tomersol/experiments/out/client.go]:

  > [line 36 : column 2] - could not import golang.org/x/oauth2 (invalid package name: "")



[/home/tomersol/experiments/out/client.go:405] - G304 (CWE-22): Potential file inclusion via variable (Confidence: HIGH, Severity: MEDIUM)
    404: func addFile(w *multipart.Writer, fieldName, path string) error {
  > 405: 	file, err := os.Open(path)
    406: 	if err != nil {



[/home/tomersol/experiments/out/client.go:409] - G307 (CWE-703): Deferring unsafe method "Close" on type "*os.File" (Confidence: HIGH, Severity: MEDIUM)
    408: 	}
  > 409: 	defer file.Close()
    410: 



[/home/tomersol/experiments/out/client.go:263] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    262: 		headerParams["Content-Length"] = fmt.Sprintf("%d", body.Len())
  > 263: 		w.Close()
    264: 	}



[/home/tomersol/experiments/out/client.go:240] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    239: 				} else { // form value
  > 240: 					w.WriteField(k, iv)
    241: 				}



[/home/tomersol/experiments/out/api_default.go:112] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    111: 	localVarBody, err := _ioutil.ReadAll(localVarHTTPResponse.Body)
  > 112: 	localVarHTTPResponse.Body.Close()
    113: 	localVarHTTPResponse.Body = _ioutil.NopCloser(bytes.NewBuffer(localVarBody))



Summary:
  Gosec  : dev
  Files  : 7
  Lines  : 1512
  Nosec  : 0
  Issues : 5

Expected output

Running gosec without raising warnings.

Suggest a fix

Alter the generated code such that it doesn't raise the above warnings. Each warning can be handled fairly easy. For example use

file, err := os.Open(filepath.Clean(path))

instead of

file, err := os.Open(path)

See https://github.com/fybrik/fybrik/pull/1109 where we fixed the generated files manually.

Reproduce the issue with openapi-generator generate, go mod download, and gosec ./..., then inspect the reported generated files client.go and api_default.go. Trace those outputs back to the Go generator entry points and verify the generated client passes gosec without the listed warnings.