fix(security): Go-Git Has an Argument Injection via the URL Field (DD-3703)

[defectdojo-sensei-demo]

Automated remediation generated by DefectDojo Sensei.

This pull request applies a fix for 1 security finding.

Commit: d725c94555c6017c2884c776aa2c455c7141b86f

---

DD-3703: Go-Git Has an Argument Injection via the URL Field

Severity: High

File: go.mod

The vulnerability GHSA-v725-9546-7q7m affects gopkg.in/src-d/go-git.v4, which is an archived/unmaintained fork of go-git. This library is vulnerable to argument injection via the URL field when making git operations that delegate to the git binary. An attacker who can control the repository URL could inject additional git command-line arguments (e.g., --upload-pack=malicious-command), potentially leading to remote code execution. The fix is to migrate from the abandoned gopkg.in/src-d/go-git.v4 to the actively maintained successor github.com/go-git/go-git/v5, which has patched this vulnerability.

Suggested change

```diff
 require (
 	github.com/briandowns/spinner v1.6.1
 	github.com/mtesauro/commandeer v1.1.4
 	github.com/spf13/viper v1.4.0
 	golang.org/x/text v0.13.0
-	gopkg.in/src-d/go-git.v4 v4.12.0
+	github.com/go-git/go-git/v5 v5.12.0
 )
 
 require (
 	github.com/emirpasic/gods v1.12.0 // indirect
 	github.com/fatih/color v1.7.0 // indirect
 	github.com/fsnotify/fsnotify v1.4.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kevinburke/ssh_config v0.0.0-20180830205328-81db2a75821e // indirect
 	github.com/magiconair/properties v1.8.0 // indirect
 	github.com/mattn/go-colorable v0.1.2 // indirect
 	github.com/mattn/go-isatty v0.0.8 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.1.2 // indirect
-	github.com/pelletier/go-buffruneio v0.2.0 // indirect
 	github.com/pelletier/go-toml v1.2.0 // indirect
 	github.com/sergi/go-diff v1.0.0 // indirect
 	github.com/spf13/afero v1.1.2 // indirect
 	github.com/spf13/cast v1.3.0 // indirect
 	github.com/spf13/jwalterweatherman v1.0.0 // indirect
 	github.com/spf13/pflag v1.0.3 // indirect
-	github.com/src-d/gcfg v1.4.0 // indirect
+	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+	github.com/go-git/go-billy/v5 v5.6.1 // indirect
 	github.com/xanzy/ssh-agent v0.2.1 // indirect
 	golang.org/x/crypto v0.14.0 // indirect
 	golang.org/x/net v0.17.0 // indirect
 	golang.org/x/sys v0.13.0 // indirect
-	gopkg.in/src-d/go-billy.v4 v4.3.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )

Important: After editing go.mod, you must also:

1. Update all import paths in your Go source files from gopkg.in/src-d/go-git.v4 to github.com/go-git/go-git/v5.
2. Run go mod tidy to regenerate go.sum and resolve all transitive dependencies automatically. The go.sum file will need to be regenerated entirely due to the package change.

</details>

---

_Review the change before merging._

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud