actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-12-25 12:05:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Rebase to master

Browse source
This commit is contained in:
Jon McClintock 2018-01-22 18:45:07 +00:00
parent 8eb9cc02a4
commit 1ca335016a
2 changed files with 27 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
rules/sql.go
View file

@ -29,7 +29,7 @@ type sqlStatement struct {
} }
// See if the string matches the patterns for the statement. // See if the string matches the patterns for the statement.
func (s sqlStatement) Match(str string) bool { func (s sqlStatement) MatchPatterns(str string) bool {
for _, pattern := range s.patterns { for _, pattern := range s.patterns {
if !pattern.MatchString(str) { if !pattern.MatchString(str) {
return false return false
@ -55,7 +55,7 @@ func (s *sqlStrConcat) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
if node, ok := n.(*ast.BinaryExpr); ok { if node, ok := n.(*ast.BinaryExpr); ok {
if start, ok := node.X.(*ast.BasicLit); ok { if start, ok := node.X.(*ast.BasicLit); ok {
if str, e := gas.GetString(start); e == nil { if str, e := gas.GetString(start); e == nil {
if !s.Match(str) { if !s.MatchPatterns(str) {
return nil, nil return nil, nil
} }
if _, ok := node.Y.(*ast.BasicLit); ok { if _, ok := node.Y.(*ast.BasicLit); ok {
@ -73,8 +73,8 @@ func (s *sqlStrConcat) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
// NewSQLStrConcat looks for cases where we are building SQL strings via concatenation // NewSQLStrConcat looks for cases where we are building SQL strings via concatenation
func NewSQLStrConcat(conf gas.Config) (gas.Rule, []ast.Node) { func NewSQLStrConcat(conf gas.Config) (gas.Rule, []ast.Node) {
return &SqlStrConcat{ return &sqlStrConcat{
SqlStatement: SqlStatement{ sqlStatement: sqlStatement{
patterns: []*regexp.Regexp{ patterns: []*regexp.Regexp{
regexp.MustCompile(`(?)(SELECT|DELETE|INSERT|UPDATE|INTO|FROM|WHERE) `), regexp.MustCompile(`(?)(SELECT|DELETE|INSERT|UPDATE|INTO|FROM|WHERE) `),
}, },
@ -97,10 +97,7 @@ func (s *sqlStrFormat) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
// TODO(gm) improve confidence if database/sql is being used // TODO(gm) improve confidence if database/sql is being used
if node := s.calls.ContainsCallExpr(n, c); node != nil { if node := s.calls.ContainsCallExpr(n, c); node != nil {
if arg, e := gas.GetString(node.Args[0]); e == nil { if arg, e := gas.GetString(node.Args[0]); s.MatchPatterns(arg) && e == nil {
if !s.Match(str) {
return nil, nil
}
return gas.NewIssue(c, n, s.What, s.Severity, s.Confidence), nil return gas.NewIssue(c, n, s.What, s.Severity, s.Confidence), nil
} }
} }

23
testutils/source.go
View file

@ -206,7 +206,28 @@ func main(){
panic(err) panic(err)
} }
defer rows.Close() defer rows.Close()
}`, 1}, { }`, 1}, {`
// Format string false positive, safe string spec.
package main
import (
"database/sql"
"fmt"
"os"
//_ "github.com/mattn/go-sqlite3"
)
func main(){
db, err := sql.Open("sqlite3", ":memory:")
if err != nil {
panic(err)
}
q := fmt.Sprintf("SELECT * FROM foo where id = %d", os.Args[1])
rows, err := db.Query(q)
if err != nil {
panic(err)
}
defer rows.Close()
}`, 0}, {
` `
// Format string false positive // Format string false positive
package main package main