continue
		}

		switch key {
		case "xml":
			// If the first or last character in the XML tag is a space, it is
			// suspicious.
			if strings.Trim(value, " ") != value {
				return errTagValueSpace
			}

			// If there are multiple spaces, they are suspicious.
			if strings.Count(value, " ") > 1 {
				return errTagValueSpace
			}

			// If there is no comma, skip the rest of the checks.

#
# As of 1.21 we continue to use internal linking for programs whose
# CGO use comes only from stdlib packages in the absence of any flag
# funny business, however if the Go command sees flags that may be suspicious,
# it signals the Go linker to invoke the external linker.

# The next few tests run builds passing "-n" to the Go command, then
# checking the output to see if the Go command is trying to pass a

        bugprone-macro-repeated-side-effects,
        bugprone-misplaced-widening-cast,
        bugprone-move-forwarding-reference,
        bugprone-multiple-statement-macro,
        bugprone-suspicious-semicolon,
        bugprone-swapped-arguments,
        bugprone-terminating-continue,
        bugprone-unused-raii,
        bugprone-unused-return-value,
        misc-redundant-expression,
        misc-static-assert,

    @Test
    fun `unzip fails on path traversal attempts`() {

        val maliciousZip = file("malicious.zip").apply {
            ZipOutputStream(outputStream()).use { zip ->
                val content = "suspicious".toByteArray()
                zip.putNextEntry(ZipEntry("path/../../traversal.txt".replace('/', File.separatorChar)).apply { size = content.size.toLong() })
                zip.write(content)
                zip.closeEntry()

// Copyright 2018 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

/*
Vet examines Go source code and reports suspicious constructs, such as Printf
calls whose arguments do not align with the format string. Vet uses heuristics
that do not guarantee all reports are genuine problems, but it can find errors
not caught by the compilers.

	if current == nil {
		log.Debugf("ADS:%s: resources initialized", v3.GetShortType(w.TypeUrl))
		return
	}
	if deltaRes == nil && deleted == nil && len(sotwRes) == 0 {
		// TODO: it suspicious full is never nil - are there case where we should be deleting everything?
		// Both SotW and Delta did not respond, nothing to compare
		return
	}
	newByName := slices.GroupUnique(sotwRes, (*discovery.Resource).GetName)

                    .filterNot { it.trim().startsWith("//") }
                    .joinToString("\n")
                if (text.contains(content) && exceptions.all { !text.contains(it) }) {
                    println("Found suspicious test file: $file")
                    return true
                }
            }
        }
        return false
    }

    @Test
    fun allSubprojectsDefineTheirFunctionTestPropertyCorrectly() {

        ResolvedComponentResult targetComponent = findComponent(value, componentIdentifier);

        if (targetComponent == null) {
            // TODO: This is very suspicious. We should always fail here.
            // `strict` was added because file dependencies' components are never included in the graph.
            // We should detect this earlier and return no dependencies there to avoid `strict`.

		msg := fmt.Sprintf("received record with version %x when expecting version %x", vers, expectedVers)
		return c.in.setErrorLocked(c.newRecordHeaderError(nil, msg))
	}
	if !c.haveVers {
		// First message, be extra suspicious: this might not be a TLS
		// client. Bail out before reading a full 'body', if possible.
		// The current max version is 3.3 so if the version is >= 16.0,
		// it's probably not real.

				constants.AmbientWaypointInboundBinding: "PROXY/15088",
			},
		},
	})
	s.addWaypoint(t, "1.2.3.4", "proxy-sandwich", constants.AllTraffic, true)
	// TODO needing this check seems suspicious. We should really wait for up to 2 pod events.
	assert.EventuallyEqual(t, func() int { return len(s.waypoints.List()) }, 1)