Extend the bind rule to handle the case when the net.Listen address in provided from a const

helpers.go

@@ -178,7 +178,17 @@ func GetCallStringArgsValues(n ast.Node, ctx *Context) []string {
 					values = append(values, value)
 				}
 			case *ast.Ident:
-				obj := param.Obj
+				values = append(values, GetIdentStringValues(param)...)
+			}
+		}
+	}
+	return values
+}
+
+// GetIdentStringValues return the string values of an Ident if they can be resolved
+func GetIdentStringValues(ident *ast.Ident) []string {
+	values := []string{}
+	obj := ident.Obj
 	if obj != nil {
 		switch decl := obj.Decl.(type) {
 		case *ast.ValueSpec:
@@ -198,9 +208,6 @@ func GetCallStringArgsValues(n ast.Node, ctx *Context) []string {
 		}
 
 	}
-			}
-		}
-	}
 	return values
 }
 

rules/bind.go

@@ -45,6 +45,13 @@ func (r *bindsToAllNetworkInterfaces) Match(n ast.Node, c *gosec.Context) (*gose
 					return gosec.NewIssue(c, n, r.ID(), r.What, r.Severity, r.Confidence), nil
 				}
 			}
+		} else if ident, ok := arg.(*ast.Ident); ok {
+			values := gosec.GetIdentStringValues(ident)
+			for _, value := range values {
+				if r.pattern.MatchString(value) {
+					return gosec.NewIssue(c, n, r.ID(), r.What, r.Severity, r.Confidence), nil
+				}
+			}
 		}
 	} else if len(callExpr.Args) > 0 {
 		values := gosec.GetCallStringArgsValues(callExpr.Args[0], c)

testutils/source.go

@@ -134,6 +134,21 @@ func main() {
 		log.Fatal(err)
 	}
 	defer l.Close()
+}`}, 1},
+		{[]string{`
+package main
+import (
+	"log"
+   	"net"
+)
+const addr = "0.0.0.0:2000"
+
+func main() {
+	l, err := net.Listen("tcp", addr)
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer l.Close()
 }`}, 1},
 	}
 	// SampleCodeG103 find instances of unsafe blocks for auditing purposes