gosec/rules/archive.go

67 lines
1.7 KiB
Go
Raw Permalink Normal View History

package rules
import (
"go/ast"
"go/types"
"github.com/securego/gosec/v2"
2023-02-15 19:44:13 +00:00
"github.com/securego/gosec/v2/issue"
)
type archive struct {
2023-02-15 19:44:13 +00:00
issue.MetaData
calls gosec.CallList
argTypes []string
}
func (a *archive) ID() string {
return a.MetaData.ID
}
// Match inspects AST nodes to determine if the filepath.Joins uses any argument derived from type zip.File or tar.Header
2023-02-15 19:44:13 +00:00
func (a *archive) Match(n ast.Node, c *gosec.Context) (*issue.Issue, error) {
if node := a.calls.ContainsPkgCallExpr(n, c, false); node != nil {
for _, arg := range node.Args {
var argType types.Type
if selector, ok := arg.(*ast.SelectorExpr); ok {
argType = c.Info.TypeOf(selector.X)
} else if ident, ok := arg.(*ast.Ident); ok {
if ident.Obj != nil && ident.Obj.Kind == ast.Var {
decl := ident.Obj.Decl
if assign, ok := decl.(*ast.AssignStmt); ok {
if selector, ok := assign.Rhs[0].(*ast.SelectorExpr); ok {
argType = c.Info.TypeOf(selector.X)
}
}
}
}
if argType != nil {
for _, t := range a.argTypes {
if argType.String() == t {
2023-02-15 19:44:13 +00:00
return c.NewIssue(n, a.ID(), a.What, a.Severity, a.Confidence), nil
}
}
}
}
}
return nil, nil
}
// NewArchive creates a new rule which detects the file traversal when extracting zip/tar archives
2023-03-20 09:08:49 +00:00
func NewArchive(id string, _ gosec.Config) (gosec.Rule, []ast.Node) {
calls := gosec.NewCallList()
calls.Add("path/filepath", "Join")
calls.Add("path", "Join")
return &archive{
calls: calls,
argTypes: []string{"*archive/zip.File", "*archive/tar.Header"},
2023-02-15 19:44:13 +00:00
MetaData: issue.MetaData{
ID: id,
2023-02-15 19:44:13 +00:00
Severity: issue.Medium,
Confidence: issue.High,
What: "File traversal when extracting zip/tar archive",
},
}, []ast.Node{(*ast.CallExpr)(nil)}
}