From 68aac2539a5122d3c0696224ba52b525c5a03819 Mon Sep 17 00:00:00 2001
From: Tim Kelsey <tim.kelsey@hpe.com>
Date: Thu, 28 Jul 2016 12:51:25 +0100
Subject: [PATCH] Fixing annotations

The logic around annotations (nosec) was broken, meaning they were
ignored by default and would not skip sub-blocks. This fixes the
problem and also adds a test to make sure it wont be broken in the
future. Closes #25
---
 core/analyzer.go    | 13 +++++-----
 main.go             |  4 +--
 rules/nosec_test.go | 60 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+), 8 deletions(-)
 create mode 100644 rules/nosec_test.go

diff --git a/core/analyzer.go b/core/analyzer.go
index 1cf3730..e20bf1c 100644
--- a/core/analyzer.go
+++ b/core/analyzer.go
@@ -47,7 +47,7 @@ type Metrics struct {
 }
 
 type Analyzer struct {
-	annotations bool
+	ignoreNosec bool
 	ruleset     RuleSet
 	context     Context
 	logger      *log.Logger
@@ -55,12 +55,12 @@ type Analyzer struct {
 	Stats       Metrics `json:"metrics"`
 }
 
-func NewAnalyzer(annotations bool, logger *log.Logger) Analyzer {
+func NewAnalyzer(ignoreNosec bool, logger *log.Logger) Analyzer {
 	if logger == nil {
 		logger = log.New(os.Stdout, "[gas]", 0)
 	}
 	return Analyzer{
-		annotations: annotations,
+		ignoreNosec: ignoreNosec,
 		ruleset:     make(RuleSet),
 		Issues:      make([]Issue, 0),
 		context:     Context{token.NewFileSet(), nil, nil, nil},
@@ -124,7 +124,7 @@ func (gas *Analyzer) ProcessSource(filename string, source string) error {
 }
 
 func (gas *Analyzer) Ignore(n ast.Node) bool {
-	if groups, ok := gas.context.Comments[n]; ok {
+	if groups, ok := gas.context.Comments[n]; ok && !gas.ignoreNosec {
 		for _, group := range groups {
 			if strings.Contains(group.Text(), "nosec") {
 				gas.Stats.NumNosec++
@@ -136,7 +136,7 @@ func (gas *Analyzer) Ignore(n ast.Node) bool {
 }
 
 func (gas *Analyzer) Visit(n ast.Node) ast.Visitor {
-	if !gas.annotations || gas.Ignore(n) {
+	if !gas.Ignore(n) {
 		if val, ok := gas.ruleset[reflect.TypeOf(n)]; ok {
 			for _, rule := range val {
 				ret, err := rule.Match(n, &gas.context)
@@ -150,6 +150,7 @@ func (gas *Analyzer) Visit(n ast.Node) ast.Visitor {
 				}
 			}
 		}
+		return gas
 	}
-	return gas
+	return nil
 }
diff --git a/main.go b/main.go
index 6d85fbc..e64bf90 100644
--- a/main.go
+++ b/main.go
@@ -27,7 +27,7 @@ import (
 )
 
 // #nosec flag
-var flagNoSec = flag.Bool("nosec", false, "Ignores #nosec comments when set")
+var flagIgnoreNoSec = flag.Bool("nosec", false, "Ignores #nosec comments when set")
 
 // format output
 var flagFormat = flag.String("fmt", "text", "Set output format. Valid options are: json, csv of text")
@@ -99,7 +99,7 @@ func main() {
 	}
 
 	// Setup analyzer
-	analyzer := gas.NewAnalyzer(*flagNoSec, logger)
+	analyzer := gas.NewAnalyzer(*flagIgnoreNoSec, logger)
 	if !rules.overwritten {
 		rules.useDefaults()
 	}
diff --git a/rules/nosec_test.go b/rules/nosec_test.go
new file mode 100644
index 0000000..e6616a5
--- /dev/null
+++ b/rules/nosec_test.go
@@ -0,0 +1,60 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"testing"
+
+	gas "github.com/HewlettPackard/gas/core"
+)
+
+func TestNosec(t *testing.T) {
+	analyzer := gas.NewAnalyzer(false, nil)
+	analyzer.AddRule(NewSubproc())
+
+	issues := gasTestRunner(
+		`package main
+
+    import (
+    	"fmt"
+    )
+
+    func main() {
+      cmd := exec.Command("sh", "-c", config.Command) // #nosec
+    }`, analyzer)
+
+	checkTestResults(t, issues, 0, "None")
+}
+
+func TestNosecBlock(t *testing.T) {
+	analyzer := gas.NewAnalyzer(false, nil)
+	analyzer.AddRule(NewSubproc())
+
+	issues := gasTestRunner(
+		`package main
+
+    import (
+    	"fmt"
+    )
+
+    func main() {
+			// #nosec
+			if true {
+      	cmd := exec.Command("sh", "-c", config.Command)
+			}
+    }`, analyzer)
+
+	checkTestResults(t, issues, 0, "None")
+}