diff --git a/rules/subproc.go b/rules/subproc.go index 48a0726..4110d9d 100644 --- a/rules/subproc.go +++ b/rules/subproc.go @@ -81,5 +81,7 @@ func NewSubproc(id string, conf gosec.Config) (gosec.Rule, []ast.Node) { rule.Add("syscall", "Exec") rule.Add("syscall", "ForkExec") rule.Add("syscall", "StartProcess") + rule.Add("golang.org/x/sys/execabs", "Command") + rule.Add("golang.org/x/sys/execabs", "CommandContext") return rule, []ast.Node{(*ast.CallExpr)(nil)} } diff --git a/testutils/source.go b/testutils/source.go index e30516a..c69e10b 100644 --- a/testutils/source.go +++ b/testutils/source.go @@ -1368,6 +1368,24 @@ func main() { err = cmd.Wait() log.Printf("Command finished with error: %v", err) }`}, 0, gosec.NewConfig()}, + {[]string{` +// exec.Command from supplemental package sys/execabs +// using variable arguments +package main +import ( + "context" + "log" + "os" + exec "golang.org/x/sys/execabs" +) +func main() { + err := exec.CommandContext(context.Background(), os.Args[0], "5").Run() + if err != nil { + log.Fatal(err) + } + log.Printf("Command finished with error: %v", err) +} +`}, 1, gosec.NewConfig()}, } // SampleCodeG301 - mkdir permission check