Rephrase #nosec comments for DirectIOChecker
Make them more meaningfull for a security-sensitive reader.
@@ -288,12 +288,12 @@ func (c *directIOChecker) CheckFile(path string) (bool, error) {
// based on https://gitlab.com/qemu-project/qemu/-/blob/master/util/osdep.c#L344
func (c *directIOChecker) check(path string, flags int) (bool, error) {
- // #nosec No risk for path injection. No information can be exposed to attacker
+ // #nosec No risk for path injection as we only open the file, not read from it. The function leaks only whether the directory to `path` exists.
f, err := os.OpenFile(path, flags|syscall.O_DIRECT, 0600)
if err != nil {
// EINVAL is returned if the filesystem does not support the O_DIRECT flag
if err, ok := err.(*os.PathError); ok && err.Err == syscall.EINVAL {
- // #nosec No risk for path injection. No information can be exposed to attacker
+ // #nosec No risk for path injection as we only open the file, not read from it. The function leaks only whether the directory to `path` exists.
f, err := os.OpenFile(path, flags & ^syscall.O_DIRECT, 0600)
if err == nil {
defer util.CloseIOAndCheckErr(f, nil)
