refactor(deps): replace archived go-homedir with os.UserHomeDir (aquasecurity#10484)

Co-authored-by: knqyf263 <knqyf263@gmail.com>

Author: kotakanbe

go.mod

@@ -77,7 +77,7 @@ require (
 	github.com/masahiro331/go-vmdk-parser v0.0.0-20260423020818-08305fa668d2
 	github.com/masahiro331/go-xfs-filesystem v0.0.0-20260422061116-d21e5e4481bb
 	github.com/mattn/go-shellwords v1.0.12
-	github.com/mitchellh/go-homedir v1.1.0
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/moby/buildkit v0.29.0
 	github.com/moby/docker-image-spec v1.3.1

pkg/iac/scanners/terraform/parser/funcs/filesystem.go

@@ -14,9 +14,9 @@ import (
 	"github.com/bmatcuk/doublestar/v4"
 	"github.com/hashicorp/hcl/v2"
 	"github.com/hashicorp/hcl/v2/hclsyntax"
-	"github.com/mitchellh/go-homedir"
 	"github.com/zclconf/go-cty/cty"
 	"github.com/zclconf/go-cty/cty/function"
+	"golang.org/x/xerrors"
 )
 
 // MakeFileFunc constructs a function that takes a file path and returns the
@@ -196,7 +196,7 @@ func MakeFileExistsFunc(target fs.FS, baseDir string) function.Function {
 		Type: function.StaticReturnType(cty.Bool),
 		Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
 			path := args[0].AsString()
-			path, err := homedir.Expand(path)
+			path, err := expandHome(path)
 			if err != nil {
 				return cty.UnknownVal(cty.Bool), fmt.Errorf("failed to expand ~: %s", err)
 			}
@@ -350,13 +350,13 @@ var PathExpandFunc = function.New(&function.Spec{
 	Type: function.StaticReturnType(cty.String),
 	Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
 
-		homePath, err := homedir.Expand(args[0].AsString())
+		homePath, err := expandHome(args[0].AsString())
 		return cty.StringVal(homePath), err
 	},
 })
 
 func openFile(target fs.FS, baseDir, path string) (fs.File, error) {
-	path, err := homedir.Expand(path)
+	path, err := expandHome(path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to expand ~: %s", err)
 	}
@@ -404,3 +404,23 @@ func File(target fs.FS, baseDir string, path cty.Value) (cty.Value, error) {
 	fn := MakeFileFunc(target, baseDir, false)
 	return fn.Call([]cty.Value{path})
 }
+
+// expandHome expands a leading ~ in the path to the current user's home directory.
+// User-specific forms like ~user/foo are not supported and return an error,
+// matching the behavior of the archived github.com/mitchellh/go-homedir Expand.
+func expandHome(path string) (string, error) {
+	if len(path) == 0 {
+		return path, nil
+	}
+	if path[0] != '~' {
+		return path, nil
+	}
+	if len(path) > 1 && path[1] != '/' && path[1] != '\\' {
+		return "", xerrors.New("cannot expand user-specific home dir")
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, path[1:]), nil
+}

pkg/iac/scanners/terraform/parser/funcs/filesystem_test.go

@@ -0,0 +1,80 @@
+package funcs
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestExpandHome(t *testing.T) {
+	home, err := os.UserHomeDir()
+	require.NoError(t, err)
+
+	tests := []struct {
+		name    string
+		input   string
+		want    string
+		wantErr bool
+	}{
+		{
+			name:  "tilde only",
+			input: "~",
+			want:  home,
+		},
+		{
+			name:  "tilde with forward slash path",
+			input: "~/Documents/test.tf",
+			want:  filepath.Join(home, "Documents/test.tf"),
+		},
+		{
+			name:  "tilde with nested path",
+			input: "~/a/b/c",
+			want:  filepath.Join(home, "a/b/c"),
+		},
+		{
+			name:  "absolute path unchanged",
+			input: "/etc/passwd",
+			want:  "/etc/passwd",
+		},
+		{
+			name:  "relative path unchanged",
+			input: "relative/path",
+			want:  "relative/path",
+		},
+		{
+			name:  "empty string",
+			input: "",
+			want:  "",
+		},
+		{
+			name:  "tilde in middle unchanged",
+			input: "/foo/~/bar",
+			want:  "/foo/~/bar",
+		},
+		{
+			name:    "user-specific home dir is not supported",
+			input:   "~username",
+			wantErr: true,
+		},
+		{
+			name:    "user-specific home dir with path is not supported",
+			input:   "~foo/foo",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := expandHome(tt.input)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}