build(deps): Bump github.com/tinylib/msgp from 1.1.5 to 1.1.8 in /receiver/fluentforwardreceiver

[dependabot]

Bumps github.com/tinylib/msgp from 1.1.5 to 1.1.8.

Release notes

Sourced from github.com/tinylib/msgp's releases.

v1.1.6

Capture some small changes since the v1.1.5 release. The biggest user-facing change is the lack of diagnostics printed to stderr unless -v is passed explicitly.

Commits

• 8a5e756 README: update link to docs website, and add docs reference badge
• aab9129 go.mod: update go version to 1.15 to match what's tested
• 87d7486 fix some godoc comments, and add docs links
• 15e1d85 gofumpt code
• 0fc7365 gofmt for current versions of go and remove stray whitespace
• f75b7bc go.mod: github.com/philhofer/fwd v1.1.2
• 64463c4 go mod tidy
• 7f4e0b9 remove .travis.yml
• aedaed6 add github actions and golangci-lint
• ea4a7b2 Update tinygo version to v0.26.0 to fix version detection
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[guardrails]

⚠️ We detected 76 security issues in this pull request:

Mode: paranoid | Total findings: 76 | Considered vulnerability: 76

Insecure Network Communication (13)

Docs	Details
💡	Title: Insecure gRPC server connection, Severity: Medium opentelemetry-collector-contrib/exporter/googlecloudexporter/googlecloud_test.go Line 93 in 87b6c06 srv := grpc.NewServer()
💡	Title: Insecure gRPC server connection, Severity: Medium opentelemetry-collector-contrib/exporter/googlecloudexporter/googlecloud_test.go Line 168 in 87b6c06 srv := grpc.NewServer()
💡	Title: Plaintext HTTP Server, Severity: High opentelemetry-collector-contrib/internal/aws/xray/testdata/sampleserver/sample.go Line 34 in 87b6c06 go http.ListenAndServe(":8000", nil)
💡	Title: Plaintext HTTP Server, Severity: High opentelemetry-collector-contrib/receiver/prometheusexecreceiver/testdata/end_to_end_metrics_test/test_prometheus_exporter.go Line 48 in 87b6c06 err := http.ListenAndServe(fmt.Sprintf(":%v", os.Args[1]), nil)
💡	Title: Plaintext HTTP Server, Severity: High opentelemetry-collector-contrib/receiver/simpleprometheusreceiver/examples/federation/prom-counter/main.go Line 56 in 87b6c06 _ = http.ListenAndServe(":8080", nil)
💡	Title: Insecure SSL/TLS versions allowed, Severity: Medium opentelemetry-collector-contrib/internal/kubelet/client.go Line 104 in 87b6c06 RootCAs: rootCAs,
💡	Title: Look For Bad TLS Connection Settings, Severity: High opentelemetry-collector-contrib/internal/kubelet/client.go Line 103 in 87b6c06 tr.TLSClientConfig = &tls.Config{
💡	Title: Look For Bad TLS Connection Settings, Severity: High opentelemetry-collector-contrib/exporter/datadogexporter/internal/utils/http.go Line 53 in 87b6c06 TLSClientConfig: &tls.Config{InsecureSkipVerify: false},
💡	Title: Look For Bad TLS Connection Settings, Severity: High opentelemetry-collector-contrib/internal/kubelet/client.go Line 121 in 87b6c06 InsecureSkipVerify: insecureSkipVerify,
💡	Title: Look For Bad TLS Connection Settings, Severity: High opentelemetry-collector-contrib/internal/aws/awsutil/conn.go Line 63 in 87b6c06 InsecureSkipVerify: noVerify,
💡	Title: Look For Bad TLS Connection Settings, Severity: High opentelemetry-collector-contrib/exporter/sentryexporter/sentry_exporter.go Line 403 in 87b6c06 clientOptions.HTTPTransport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
💡	Title: Look For Bad TLS Connection Settings, Severity: High opentelemetry-collector-contrib/receiver/awsxrayreceiver/internal/proxy/conn.go Line 191 in 87b6c06 InsecureSkipVerify: config.TLSSetting.Insecure,
💡	Title: Look For Bad TLS Connection Settings, Severity: High opentelemetry-collector-contrib/internal/aws/awsutil/conn.go Line 166 in 87b6c06 InsecureSkipVerify: config.NoVerifySSL,

More info on how to fix Insecure Network Communication in Go.

---

Insecure Use of Dangerous Function (3)

Docs	Details
💡	Title: Review use of exec.Command(), Severity: High opentelemetry-collector-contrib/receiver/prometheusexecreceiver/subprocessmanager/manager.go Line 40 in 87b6c06 childProcess := exec.Command(args[0], args[1:]...) // #nosec
💡	Title: Audit Use of Command Execution, Severity: High opentelemetry-collector-contrib/receiver/jmxreceiver/internal/subprocess/subprocess.go Line 303 in 87b6c06 cmd := exec.Command(execPath, args...)
💡	Title: Audit Use of Command Execution, Severity: High opentelemetry-collector-contrib/extension/fluentbitextension/process.go Line 192 in 87b6c06 cmd := exec.Command(execPath, args...)

More info on how to fix Insecure Use of Dangerous Function in Go.

---

Insecure Use of SQL Queries (1)

Docs	Details
💡	Title: SQL Injection - go-pg ORM string concatenation, Severity: High opentelemetry-collector-contrib/receiver/dotnetdiagnosticsreceiver/network/fake_rw.go Line 87 in 87b6c06 return path.Join(dir, fmt.Sprintf("msg.%d.bin", i))

More info on how to fix Insecure Use of SQL Queries in Go.

---

Insecure File Management (11)

Docs	Details
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/testbed/datasenders/fluent.go Line 66 in 87b6c06 f.dataFile, err = os.OpenFile(dataFileName, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/receiver/awsxrayreceiver/internal/proxy/conn.go Line 167 in 87b6c06 metadata, err := ioutil.ReadFile(metadataFilePath)
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/receiver/awscontainerinsightreceiver/internal/ecsInfo/cgroup.go Line 213 in 87b6c06 f, err := os.Open(mountConfigPath)
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/receiver/awscontainerinsightreceiver/internal/ecsInfo/cgroup.go Line 186 in 87b6c06 out, err := ioutil.ReadFile(cgroupFile)
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/receiver/awscontainerinsightreceiver/internal/cadvisor/testutils/helpers.go Line 28 in 87b6c06 info, err := ioutil.ReadFile(file)
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk/fs.go Line 31 in 87b6c06 return os.Open(name)
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/internal/kubelet/cert.go Line 33 in 87b6c06 certBytes, err := ioutil.ReadFile(certPath)
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/exporter/signalfxexporter/internal/hostmetadata/host.go Line 205 in 87b6c06 if file, err = ioutil.ReadFile(path); err == nil {
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/exporter/signalfxexporter/internal/hostmetadata/host.go Line 172 in 87b6c06 if value, err := ioutil.ReadFile(filepath.Join(etc, "system-release")); err == nil {
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/exporter/signalfxexporter/internal/hostmetadata/host.go Line 169 in 87b6c06 if value, err := ioutil.ReadFile(filepath.Join(etc, "redhat-release")); err == nil {
💡	Title: File Path Provided As Taint Input, Severity: High opentelemetry-collector-contrib/exporter/signalfxexporter/internal/hostmetadata/host.go Line 166 in 87b6c06 if value, err := ioutil.ReadFile(filepath.Join(etc, "centos-release")); err == nil {

More info on how to fix Insecure File Management in Go.

---

Hard-Coded Secrets (48)

Docs	Details
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/alibabacloudlogserviceexporter/README.md Line 28 in 87b6c06 access_key_secret: "access-key-secret"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/alibabacloudlogserviceexporter/config_test.go Line 54 in 87b6c06 AccessKeySecret: "test-secret",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/alibabacloudlogserviceexporter/uploader.go Line 64 in 87b6c06 producerConfig.AccessKeySecret = config.AccessKeySecret
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/datadogexporter/internal/utils/http_test.go Line 41 in 87b6c06 apiKey := "apikey"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/datadogexporter/trace_connection.go Line 59 in 87b6c06 apiKey: apiKey,
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/elasticexporter/README.md Line 76 in 87b6c06 # secret_token: "hunter2"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/elasticexporter/config_test.go Line 54 in 87b6c06 APIKey: "RTNxMjlXNEJt",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/elasticexporter/config_test.go Line 55 in 87b6c06 SecretToken: "hunter2",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/elasticexporter/config_test.go Line 88 in 87b6c06 cfg.APIKey = apiKey
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/elasticexporter/config_test.go Line 89 in 87b6c06 cfg.SecretToken = secretToken
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/elasticsearchexporter/config_test.go Line 56 in 87b6c06 Password: "search",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/elasticsearchexporter/config_test.go Line 57 in 87b6c06 APIKey: "AvFsEiPs==",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/elasticsearchexporter/exporter.go Line 235 in 87b6c06 Password: config.Authentication.Password,
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/elasticsearchexporter/exporter.go Line 236 in 87b6c06 APIKey: config.Authentication.APIKey,
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/honeycombexporter/README.md Line 30 in 87b6c06 api_key: "my-api-key"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/honeycombexporter/config_test.go Line 49 in 87b6c06 APIKey: "test-apikey",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/honeycombexporter/honeycomb_test.go Line 107 in 87b6c06 APIKey: "test",
💡	Title: Hex High Entropy String, Severity: Medium opentelemetry-collector-contrib/exporter/honeycombexporter/ids_test.go Line 33 in 87b6c06 want: "cbe4decd12429177",
💡	Title: Hex High Entropy String, Severity: Medium opentelemetry-collector-contrib/exporter/honeycombexporter/ids_test.go Line 38 in 87b6c06 want: "f23b42eac289a0fdcde48fcbe3ab1a32",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/newrelicexporter/config_test.go Line 56 in 87b6c06 APIKey: "a1b2c3d4",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/newrelicexporter/factory_test.go Line 41 in 87b6c06 nrConfig.MetricsConfig.APIKey = "a1b2c3d4"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/newrelicexporter/factory_test.go Line 62 in 87b6c06 nrConfig.MetricsConfig.APIKeyHeader = "api-key"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/newrelicexporter/metrics.go Line 176 in 87b6c06 apiKey: "not_present",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/newrelicexporter/metrics_test.go Line 66 in 87b6c06 apiKey: "shhh",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/newrelicexporter/newrelic_test.go Line 85 in 87b6c06 c.TracesConfig.APIKeyHeader = "api-key"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/newrelicexporter/newrelic_test.go Line 87 in 87b6c06 c.TracesConfig.APIKey = "NRII-1"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/newrelicexporter/newrelic_test.go Line 191 in 87b6c06 useAPIKeyHeader := apiKey != ""
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/newrelicexporter/newrelic_test.go Line 762 in 87b6c06 cfg := mockConfig{useAPIKeyHeader: false}
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/exporter/observiqexporter/factory_test.go Line 41 in 87b6c06 cfg.APIKey = exampleAPIKey
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/extension/oauth2clientauthextension/config_test.go Line 42 in 87b6c06 expected.ClientSecret = "someclientsecret"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/extension/oauth2clientauthextension/extension.go Line 66 in 87b6c06 ClientSecret: cfg.ClientSecret,
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/extension/oauth2clientauthextension/extension_test.go Line 47 in 87b6c06 ClientSecret: "testsecret",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/extension/oauth2clientauthextension/factory_test.go Line 54 in 87b6c06 ClientSecret: "testsecret",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/extension/oauth2clientauthextension/factory_test.go Line 74 in 87b6c06 cfg.ClientSecret = testcase.settings.ClientSecret
💡	Title: Base64 High Entropy String, Severity: Medium opentelemetry-collector-contrib/internal/aws/k8s/k8sclient/obj_store_test.go Line 109 in 87b6c06 SelfLink: "/api/v1/namespaces/kube-system/pods/coredns-7554568866-26jdf",
💡	Title: Base64 High Entropy String, Severity: Medium opentelemetry-collector-contrib/internal/aws/k8s/k8sclient/pod_test.go Line 47 in 87b6c06 SelfLink: "/api/v1/namespaces/kube-system/pods/coredns-7554568866-26jdf",
💡	Title: Hex High Entropy String, Severity: Medium opentelemetry-collector-contrib/internal/aws/xray/tracesegment_test.go Line 533 in 87b6c06 String("d8453812a556"),
💡	Title: Hex High Entropy String, Severity: Medium opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/aws/ecs/metadata_ecs_test.go Line 89 in 87b6c06 assert.Equal(t, "abcdef12345", fetchResp.DockerID)
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/receiver/awsxrayreceiver/internal/proxy/conn_test.go Line 287 in 87b6c06 "AWS_SECRET_KEY": "SECRET",
💡	Title: Hex High Entropy String, Severity: Medium opentelemetry-collector-contrib/receiver/fluentforwardreceiver/receiver_test.go Line 187 in 87b6c06 const chunkValue = "abcdef01234576789"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/receiver/jmxreceiver/config_test.go Line 62 in 87b6c06 Password: "mypassword",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/receiver/jmxreceiver/config_test.go Line 74 in 87b6c06 KeystorePassword: "mykeystorepassword",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/receiver/jmxreceiver/config_test.go Line 77 in 87b6c06 TruststorePassword: "mytruststorepassword",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/receiver/jmxreceiver/integration_test.go Line 151 in 87b6c06 Password: "cassandra",
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/receiver/kubeletstatsreceiver/internal/kubelet/conventions.go Line 27 in 87b6c06 labelValueSecretVolume = "secret"
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/receiver/kubeletstatsreceiver/internal/kubelet/volume.go Line 100 in 87b6c06 case volume.Secret != nil:
💡	Title: Secret Keyword, Severity: Medium opentelemetry-collector-contrib/receiver/redisreceiver/receiver.go Line 51 in 87b6c06 Password: r.config.Password,
💡	Title: Private Key, Severity: Medium opentelemetry-collector-contrib/testbed/mockdatareceivers/mockawsxrayreceiver/server.key Line 1 in 87b6c06 -----BEGIN PRIVATE KEY-----

More info on how to fix Hard-Coded Secrets in General.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.