actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-12-25 20:15:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #109 from GoASTScanner/bugfix

Browse source 
Ensure hardcoded credentials check only considers constant strings
This commit is contained in:
Grant Murphy 2017-01-11 10:03:53 -08:00 committed by GitHub
commit 0545d13d8a
2 changed files with 35 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
rules/hardcoded_credentials.go
View file

@ -41,7 +41,7 @@ func (r *Credentials) matchAssign(assign *ast.AssignStmt, ctx *gas.Context) (*ga
if ident, ok := i.(*ast.Ident); ok { if ident, ok := i.(*ast.Ident); ok {
if r.pattern.MatchString(ident.Name) { if r.pattern.MatchString(ident.Name) {
for _, e := range assign.Rhs { for _, e := range assign.Rhs {
if _, ok := e.(*ast.BasicLit); ok { if rhs, ok := e.(*ast.BasicLit); ok && rhs.Kind == token.STRING {
return gas.NewIssue(ctx, assign, r.What, r.Severity, r.Confidence), nil return gas.NewIssue(ctx, assign, r.What, r.Severity, r.Confidence), nil
} }
} }
@ -63,7 +63,7 @@ func (r *Credentials) matchGenDecl(decl *ast.GenDecl, ctx *gas.Context) (*gas.Is
if len(valueSpec.Values) <= index { if len(valueSpec.Values) <= index {
index = len(valueSpec.Values) - 1 index = len(valueSpec.Values) - 1
} }
if _, ok := valueSpec.Values[index].(*ast.BasicLit); ok { if rhs, ok := valueSpec.Values[index].(*ast.BasicLit); ok && rhs.Kind == token.STRING {
return gas.NewIssue(ctx, decl, r.What, r.Severity, r.Confidence), nil return gas.NewIssue(ctx, decl, r.What, r.Severity, r.Confidence), nil
} }
} }

33
rules/hardcoded_credentials_test.go
View file

@ -111,3 +111,36 @@ func TestHardecodedVarsNotAssigned(t *testing.T) {
}`, analyzer) }`, analyzer)
checkTestResults(t, issues, 1, "Potential hardcoded credentials") checkTestResults(t, issues, 1, "Potential hardcoded credentials")
} }
func TestHardcodedConstInteger(t *testing.T) {
config := map[string]interface{}{"ignoreNosec": false}
analyzer := gas.NewAnalyzer(config, nil)
analyzer.AddRule(NewHardcodedCredentials(config))
issues := gasTestRunner(`
package main
const (
ATNStateSomethingElse = 1
ATNStateTokenStart = 42
)
func main() {
println(ATNStateTokenStart)
}`, analyzer)
checkTestResults(t, issues, 0, "Potential hardcoded credentials")
}
func TestHardcodedConstString(t *testing.T) {
config := map[string]interface{}{"ignoreNosec": false}
analyzer := gas.NewAnalyzer(config, nil)
analyzer.AddRule(NewHardcodedCredentials(config))
issues := gasTestRunner(`
package main
const (
ATNStateTokenStart = "foo bar"
)
func main() {
println(ATNStateTokenStart)
}`, analyzer)
checkTestResults(t, issues, 1, "Potential hardcoded credentials")
}