Find more tempdirs

* Find G303 in string concatenations, with os.TempDir, and in path.Join args

* Find G303 with /usr/tmp, too

/usr/tmp is commonly found e.g. on Solaris.
This commit is contained in:
Ville Skyttä 2022-01-03 22:58:25 +02:00 committed by GitHub
parent 827fca9a83
commit 19bda8d15f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 57 additions and 8 deletions

View file

@ -25,17 +25,39 @@ type badTempFile struct {
gosec.MetaData gosec.MetaData
calls gosec.CallList calls gosec.CallList
args *regexp.Regexp args *regexp.Regexp
argCalls gosec.CallList
nestedCalls gosec.CallList
} }
func (t *badTempFile) ID() string { func (t *badTempFile) ID() string {
return t.MetaData.ID return t.MetaData.ID
} }
func (t *badTempFile) findTempDirArgs(n ast.Node, c *gosec.Context, suspect ast.Node) *gosec.Issue {
if s, e := gosec.GetString(suspect); e == nil {
if t.args.MatchString(s) {
return gosec.NewIssue(c, n, t.ID(), t.What, t.Severity, t.Confidence)
}
return nil
}
if ce := t.argCalls.ContainsPkgCallExpr(suspect, c, false); ce != nil {
return gosec.NewIssue(c, n, t.ID(), t.What, t.Severity, t.Confidence)
}
if be, ok := suspect.(*ast.BinaryExpr); ok {
if ops := gosec.GetBinaryExprOperands(be); len(ops) != 0 {
return t.findTempDirArgs(n, c, ops[0])
}
return nil
}
if ce := t.nestedCalls.ContainsPkgCallExpr(suspect, c, false); ce != nil {
return t.findTempDirArgs(n, c, ce.Args[0])
}
return nil
}
func (t *badTempFile) Match(n ast.Node, c *gosec.Context) (gi *gosec.Issue, err error) { func (t *badTempFile) Match(n ast.Node, c *gosec.Context) (gi *gosec.Issue, err error) {
if node := t.calls.ContainsPkgCallExpr(n, c, false); node != nil { if node := t.calls.ContainsPkgCallExpr(n, c, false); node != nil {
if arg, e := gosec.GetString(node.Args[0]); t.args.MatchString(arg) && e == nil { return t.findTempDirArgs(n, c, node.Args[0]), nil
return gosec.NewIssue(c, n, t.ID(), t.What, t.Severity, t.Confidence), nil
}
} }
return nil, nil return nil, nil
} }
@ -45,9 +67,15 @@ func NewBadTempFile(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
calls := gosec.NewCallList() calls := gosec.NewCallList()
calls.Add("io/ioutil", "WriteFile") calls.Add("io/ioutil", "WriteFile")
calls.AddAll("os", "Create", "WriteFile") calls.AddAll("os", "Create", "WriteFile")
argCalls := gosec.NewCallList()
argCalls.Add("os", "TempDir")
nestedCalls := gosec.NewCallList()
nestedCalls.Add("path", "Join")
return &badTempFile{ return &badTempFile{
calls: calls, calls: calls,
args: regexp.MustCompile(`^/tmp/.*$|^/var/tmp/.*$`), args: regexp.MustCompile(`^(/(usr|var))?/tmp(/.*)?$`),
argCalls: argCalls,
nestedCalls: nestedCalls,
MetaData: gosec.MetaData{ MetaData: gosec.MetaData{
ID: id, ID: id,
Severity: gosec.Medium, Severity: gosec.Medium,

View file

@ -1758,6 +1758,7 @@ import (
"fmt" "fmt"
"io/ioutil" "io/ioutil"
"os" "os"
"path"
) )
func main() { func main() {
@ -1775,7 +1776,27 @@ func main() {
if err != nil { if err != nil {
fmt.Println("Error while writing!") fmt.Println("Error while writing!")
} }
}`}, 3, gosec.NewConfig()}} err = os.WriteFile("/usr/tmp/demo2", []byte("This is some data"), 0644)
if err != nil {
fmt.Println("Error while writing!")
}
err = os.WriteFile("/tmp/" + "demo2", []byte("This is some data"), 0644)
if err != nil {
fmt.Println("Error while writing!")
}
err = os.WriteFile(os.TempDir() + "/demo2", []byte("This is some data"), 0644)
if err != nil {
fmt.Println("Error while writing!")
}
err = os.WriteFile(path.Join("/var/tmp", "demo2"), []byte("This is some data"), 0644)
if err != nil {
fmt.Println("Error while writing!")
}
err = os.WriteFile(path.Join(os.TempDir(), "demo2"), []byte("This is some data"), 0644)
if err != nil {
fmt.Println("Error while writing!")
}
}`}, 8, gosec.NewConfig()}}
// SampleCodeG304 - potential file inclusion vulnerability // SampleCodeG304 - potential file inclusion vulnerability
SampleCodeG304 = []CodeSample{{[]string{` SampleCodeG304 = []CodeSample{{[]string{`