Document GoSec nosec skip comments

pkg/authentication/basic/htpasswd.go

@@ -1,6 +1,7 @@
 package basic
 
 import (
+	// We support SHA1 & bcrypt in HTPasswd
 	"crypto/sha1" // #nosec G505
 	"encoding/base64"
 	"encoding/csv"
@@ -29,6 +30,7 @@ type sha1Pass string
 // NewHTPasswdValidator constructs an httpasswd based validator from the file
 // at the path given.
 func NewHTPasswdValidator(path string) (Validator, error) {
+	// We allow HTPasswd location via config options
 	r, err := os.Open(path) // #nosec G304
 	if err != nil {
 		return nil, fmt.Errorf("could not open htpasswd file: %v", err)
@@ -90,6 +92,7 @@ func (h *htpasswdMap) Validate(user string, password string) bool {
 
 	switch rp := realPassword.(type) {
 	case sha1Pass:
+		// We support SHA1 HTPasswd entries
 		d := sha1.New() // #nosec G401
 		_, err := d.Write([]byte(password))
 		if err != nil {

pkg/upstream/http.go

@@ -103,6 +103,7 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr
 		proxy.FlushInterval = 1 * time.Second
 	}
 
+	// InsecureSkipVerify is a configurable option we allow
 	/* #nosec G402 */
 	if upstream.InsecureSkipTLSVerify {
 		proxy.Transport = &http.Transport{

pkg/util/util.go

@@ -12,6 +12,7 @@ func GetCertPool(paths []string) (*x509.CertPool, error) {
 	}
 	pool := x509.NewCertPool()
 	for _, path := range paths {
+		// Cert paths are a configurable option
 		data, err := ioutil.ReadFile(path) // #nosec G304
 		if err != nil {
 			return nil, fmt.Errorf("certificate authority file (%s) could not be read - %s", path, err)

pkg/validation/options.go

@@ -30,6 +30,7 @@ func Validate(o *options.Options) error {
 	msgs = append(msgs, validateSessionCookieMinimal(o)...)
 
 	if o.SSLInsecureSkipVerify {
+		// InsecureSkipVerify is a configurable option we allow
 		/* #nosec G402 */
 		insecureTransport := &http.Transport{
 			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},