mirror of
https://github.com/securego/gosec.git
synced 2024-12-24 11:35:52 +00:00
Add io.CopyBuffer function to rule G110
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
This commit is contained in:
parent
6bcd89aa6b
commit
110b62b05f
2 changed files with 30 additions and 1 deletions
|
@ -95,6 +95,7 @@ func NewDecompressionBombCheck(id string, conf gosec.Config) (gosec.Rule, []ast.
|
||||||
|
|
||||||
copyCalls := gosec.NewCallList()
|
copyCalls := gosec.NewCallList()
|
||||||
copyCalls.Add("io", "Copy")
|
copyCalls.Add("io", "Copy")
|
||||||
|
copyCalls.Add("io", "CopyBuffer")
|
||||||
|
|
||||||
return &decompressionBombCheck{
|
return &decompressionBombCheck{
|
||||||
MetaData: gosec.MetaData{
|
MetaData: gosec.MetaData{
|
||||||
|
|
|
@ -699,12 +699,40 @@ func main() {
|
||||||
if err != nil {
|
if err != nil {
|
||||||
panic(err)
|
panic(err)
|
||||||
}
|
}
|
||||||
io.Copy(os.Stdout, r)
|
_, err := io.Copy(os.Stdout, r)
|
||||||
|
if err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
|
||||||
r.Close()
|
r.Close()
|
||||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||||
package main
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"compress/zlib"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
)
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
buff := []byte{120, 156, 202, 72, 205, 201, 201, 215, 81, 40, 207,
|
||||||
|
47, 202, 73, 225, 2, 4, 0, 0, 255, 255, 33, 231, 4, 147}
|
||||||
|
b := bytes.NewReader(buff)
|
||||||
|
|
||||||
|
r, err := zlib.NewReader(b)
|
||||||
|
if err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
buf := make([]byte, 8)
|
||||||
|
_, err := io.CopyBuffer(os.Stdout, r, buf)
|
||||||
|
if err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
r.Close()
|
||||||
|
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||||
|
package main
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"archive/zip"
|
"archive/zip"
|
||||||
"io"
|
"io"
|
||||||
|
|
Loading…
Reference in a new issue