actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-11-06 03:55:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #211 from WillAbides/commandcontext

Browse source 
Make G204 look for CommandContext calls
This commit is contained in:
Cosmin Cojocar 2018-07-26 16:48:42 +02:00 committed by GitHub
commit 5ba647528a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
rules/subproc.go
View file

@ -58,6 +58,7 @@ func (r *subprocess) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) {
func NewSubproc(id string, conf gosec.Config) (gosec.Rule, []ast.Node) { func NewSubproc(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
rule := &subprocess{gosec.MetaData{ID: id}, gosec.NewCallList()} rule := &subprocess{gosec.MetaData{ID: id}, gosec.NewCallList()}
rule.Add("os/exec", "Command") rule.Add("os/exec", "Command")
rule.Add("os/exec", "CommandContext")
rule.Add("syscall", "Exec") rule.Add("syscall", "Exec")
return rule, []ast.Node{(*ast.CallExpr)(nil)} return rule, []ast.Node{(*ast.CallExpr)(nil)}
} }

13
testutils/source.go
View file

@ -408,6 +408,19 @@ func main() {
log.Printf("Command finished with error: %v", err) log.Printf("Command finished with error: %v", err)
}`, 1}, {` }`, 1}, {`
package main package main
import (
"log"
"os/exec"
"context"
)
func main() {
err := exec.CommandContext(context.Background(), "sleep", "5").Run()
if err != nil {
log.Fatal(err)
}
log.Printf("Command finished with error: %v", err)
}`, 1}, {`
package main
import ( import (
"log" "log"
"os" "os"