Extend the bind rule to handle the case when the net.Listen address in provided from a const

helpers.go

@@ -165,7 +165,7 @@ func GetCallInfo(n ast.Node, ctx *Context) (string, string, error) {
 	return "", "", fmt.Errorf("unable to determine call info")
 }
 
-// GetCallStringArgsValues returns the  values of strings arguments if they can be resolved
+// GetCallStringArgsValues returns the values of strings arguments if they can be resolved
 func GetCallStringArgsValues(n ast.Node, ctx *Context) []string {
 	values := []string{}
 	switch node := n.(type) {
@@ -178,28 +178,35 @@ func GetCallStringArgsValues(n ast.Node, ctx *Context) []string {
 					values = append(values, value)
 				}
 			case *ast.Ident:
-				obj := param.Obj
-				if obj != nil {
-					switch decl := obj.Decl.(type) {
-					case *ast.ValueSpec:
-						for _, v := range decl.Values {
-							value, err := GetString(v)
-							if err == nil {
-								values = append(values, value)
-							}
-						}
-					case *ast.AssignStmt:
-						for _, v := range decl.Rhs {
-							value, err := GetString(v)
-							if err == nil {
-								values = append(values, value)
-							}
-						}
-					}
+				values = append(values, GetIdentStringValues(param)...)
+			}
+		}
+	}
+	return values
+}
 
+// GetIdentStringValues return the string values of an Ident if they can be resolved
+func GetIdentStringValues(ident *ast.Ident) []string {
+	values := []string{}
+	obj := ident.Obj
+	if obj != nil {
+		switch decl := obj.Decl.(type) {
+		case *ast.ValueSpec:
+			for _, v := range decl.Values {
+				value, err := GetString(v)
+				if err == nil {
+					values = append(values, value)
+				}
+			}
+		case *ast.AssignStmt:
+			for _, v := range decl.Rhs {
+				value, err := GetString(v)
+				if err == nil {
+					values = append(values, value)
 				}
 			}
 		}
+
 	}
 	return values
 }

rules/bind.go

@@ -45,6 +45,13 @@ func (r *bindsToAllNetworkInterfaces) Match(n ast.Node, c *gosec.Context) (*gose
 					return gosec.NewIssue(c, n, r.ID(), r.What, r.Severity, r.Confidence), nil
 				}
 			}
+		} else if ident, ok := arg.(*ast.Ident); ok {
+			values := gosec.GetIdentStringValues(ident)
+			for _, value := range values {
+				if r.pattern.MatchString(value) {
+					return gosec.NewIssue(c, n, r.ID(), r.What, r.Severity, r.Confidence), nil
+				}
+			}
 		}
 	} else if len(callExpr.Args) > 0 {
 		values := gosec.GetCallStringArgsValues(callExpr.Args[0], c)

testutils/source.go

@@ -134,6 +134,21 @@ func main() {
 		log.Fatal(err)
 	}
 	defer l.Close()
+}`}, 1},
+		{[]string{`
+package main
+import (
+	"log"
+   	"net"
+)
+const addr = "0.0.0.0:2000"
+
+func main() {
+	l, err := net.Listen("tcp", addr)
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer l.Close()
 }`}, 1},
 	}
 	// SampleCodeG103 find instances of unsafe blocks for auditing purposes