G115: False positive int->uint16 with guard

[stephenc]

Summary

False positive when converting int to uint16 even with a guard

Steps to reproduce the behavior

	for i, port := range ports {
		if port < 0 || port > math.MaxUint16 {
			t.Fatalf("unexpected port %d returned, expecting range 0-%d", port, math.MaxUint16)
		}

		uports[i] = uint16(port) // #nosec G115
	}

gosec version

v2.20.1-0.20240822074752-ab3f6c1c83a0

Go version (output of 'go version')

go version go1.23.0 darwin/arm64

Operating system / Environment

OS-X

Expected behavior

I expect the range check to suppress the warning, I also expect an explicit bitmask to have the same effect, e.g. uports[i] = uint16(port & 0xffff)

Actual behavior

Both of these flag as G115 and require the // #nosec G115 comment to have the linter pass

[czechbol]

This issue should've been resolved by #1194 which was merged just now.

[ccojocar]

fixed by #1194