G118 false positive when cancel is assigned to a package-level variable

[somyabhattz]

G118 reports a false positive when the cancel function returned by context.WithCancel is assigned to a package-level variable in init() and called in a separate function within the same package (e.g., a signal handler triggered on SIGTERM/SIGINT).

main.go:87:34: G118: context cancellation function returned by WithCancel/WithTimeout/WithDeadline is not called (gosec)
	ctx, cancel = context.WithCancel(context.Background())
	                                ^
1 issues:
* gosec: 1

[ravisastryk]

Thank you @somyabhattz for reporting this issue. I have recently made a fix in PR #1596 and the fix here would be in similar lines.

The problem is that the isCancelCalled() function in G118 lacked special handling for *ssa.Global (package-level variables). When a cancel function was stored to a global in init() and called in a separate function (like a signal handler), the cross function tracking failed to detect the call across the function boundary.

The fix would be to have dedicated tracking for package-level globals, following the same pattern we used for struct fields in PR #1596. The fix will be included in the next release.