Added filepath.Abs as a sanitizer (#1643)

it calls Clean internally per Go docs.

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>

analyzers/pathtraversal.go

@@ -65,6 +65,8 @@ func PathTraversal() taint.Config {
 		Sanitizers: []taint.Sanitizer{
 			// filepath.Clean normalizes and removes traversal components
 			{Package: "path/filepath", Method: "Clean"},
+			// filepath.Abs calls Clean internally (per Go docs)
+			{Package: "path/filepath", Method: "Abs"},
 			// filepath.Base extracts just the filename, removing directory traversal
 			{Package: "path/filepath", Method: "Base"},
 			// filepath.Rel computes a relative path safely

testutils/g703_samples.go

@@ -114,6 +114,21 @@ func handler(r *http.Request) {
 	safe := path.Base(userFile)
 	os.Open(safe)
 }
+`}, 0, gosec.NewConfig()},
+	// Safe: filepath.Abs sanitizer (calls Clean internally)
+	{[]string{`
+package main
+
+import (
+	"os"
+	"path/filepath"
+)
+
+func main() {
+	filename := os.Getenv("FILE")
+	filename, _ = filepath.Abs(filename)
+	os.ReadFile(filename)
+}
 `}, 0, gosec.NewConfig()},
 	// Test: strconv sanitizer
 	{[]string{`