[🐞] Found 3 gosec issues: CWE-78 and CWE-242 about fiber HOT 4 CLOSED

OK, issue closed, but what's decision do you have? 😉

I mean, it's normal to have this issues now (Fiber is too young), but if we can use external tools (like gosec) for checking security (an not so) issues at code and save our users — let's do it! 😀

This is some info about G103 (CWE-242) issue:

1. https://securego.io/docs/rules/g103.html
2. https://go101.org/article/unsafe.html

I fixed two similar issues at #4, but I need help, because I'm not author of Fiber, unfortunately, and don't know why it's important to use unsafe.Pointer()...

from fiber.

@koddr , Fiber is build on Fasthttp and it use the same method to convert bytes to strings and vice-versa. https://github.com/valyala/fasthttp/blob/master/bytesconv.go#L332

So changing this won't matter since it's still being used by the fasthttp engine. I think adding the // #nosec G103 and a description should be fine 👍

from fiber.

@koddr Thanks for your contribution!
I merged your pull request and addressed your gosec report in the source.

unsafe.Pointer() is used to convert a byte slice to a string without memory allocation.

from fiber.

@Fenny thx for awesome framework, btw 😃

unsafe.Pointer() is used to convert a byte slice to a string without memory allocation.

Potentially, how we can solve this? Or not any other ways to do this (so easy as unsafe)?
I will go deep to this issue 👌

from fiber.