mirror of
https://github.com/securego/gosec.git
synced 2024-12-25 03:55:54 +00:00
Fixing annotations
The logic around annotations (nosec) was broken, meaning they were ignored by default and would not skip sub-blocks. This fixes the problem and also adds a test to make sure it wont be broken in the future. Closes #25
This commit is contained in:
parent
c5d271566c
commit
68aac2539a
3 changed files with 69 additions and 8 deletions
|
@ -47,7 +47,7 @@ type Metrics struct {
|
||||||
}
|
}
|
||||||
|
|
||||||
type Analyzer struct {
|
type Analyzer struct {
|
||||||
annotations bool
|
ignoreNosec bool
|
||||||
ruleset RuleSet
|
ruleset RuleSet
|
||||||
context Context
|
context Context
|
||||||
logger *log.Logger
|
logger *log.Logger
|
||||||
|
@ -55,12 +55,12 @@ type Analyzer struct {
|
||||||
Stats Metrics `json:"metrics"`
|
Stats Metrics `json:"metrics"`
|
||||||
}
|
}
|
||||||
|
|
||||||
func NewAnalyzer(annotations bool, logger *log.Logger) Analyzer {
|
func NewAnalyzer(ignoreNosec bool, logger *log.Logger) Analyzer {
|
||||||
if logger == nil {
|
if logger == nil {
|
||||||
logger = log.New(os.Stdout, "[gas]", 0)
|
logger = log.New(os.Stdout, "[gas]", 0)
|
||||||
}
|
}
|
||||||
return Analyzer{
|
return Analyzer{
|
||||||
annotations: annotations,
|
ignoreNosec: ignoreNosec,
|
||||||
ruleset: make(RuleSet),
|
ruleset: make(RuleSet),
|
||||||
Issues: make([]Issue, 0),
|
Issues: make([]Issue, 0),
|
||||||
context: Context{token.NewFileSet(), nil, nil, nil},
|
context: Context{token.NewFileSet(), nil, nil, nil},
|
||||||
|
@ -124,7 +124,7 @@ func (gas *Analyzer) ProcessSource(filename string, source string) error {
|
||||||
}
|
}
|
||||||
|
|
||||||
func (gas *Analyzer) Ignore(n ast.Node) bool {
|
func (gas *Analyzer) Ignore(n ast.Node) bool {
|
||||||
if groups, ok := gas.context.Comments[n]; ok {
|
if groups, ok := gas.context.Comments[n]; ok && !gas.ignoreNosec {
|
||||||
for _, group := range groups {
|
for _, group := range groups {
|
||||||
if strings.Contains(group.Text(), "nosec") {
|
if strings.Contains(group.Text(), "nosec") {
|
||||||
gas.Stats.NumNosec++
|
gas.Stats.NumNosec++
|
||||||
|
@ -136,7 +136,7 @@ func (gas *Analyzer) Ignore(n ast.Node) bool {
|
||||||
}
|
}
|
||||||
|
|
||||||
func (gas *Analyzer) Visit(n ast.Node) ast.Visitor {
|
func (gas *Analyzer) Visit(n ast.Node) ast.Visitor {
|
||||||
if !gas.annotations || gas.Ignore(n) {
|
if !gas.Ignore(n) {
|
||||||
if val, ok := gas.ruleset[reflect.TypeOf(n)]; ok {
|
if val, ok := gas.ruleset[reflect.TypeOf(n)]; ok {
|
||||||
for _, rule := range val {
|
for _, rule := range val {
|
||||||
ret, err := rule.Match(n, &gas.context)
|
ret, err := rule.Match(n, &gas.context)
|
||||||
|
@ -150,6 +150,7 @@ func (gas *Analyzer) Visit(n ast.Node) ast.Visitor {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
|
||||||
return gas
|
return gas
|
||||||
|
}
|
||||||
|
return nil
|
||||||
}
|
}
|
||||||
|
|
4
main.go
4
main.go
|
@ -27,7 +27,7 @@ import (
|
||||||
)
|
)
|
||||||
|
|
||||||
// #nosec flag
|
// #nosec flag
|
||||||
var flagNoSec = flag.Bool("nosec", false, "Ignores #nosec comments when set")
|
var flagIgnoreNoSec = flag.Bool("nosec", false, "Ignores #nosec comments when set")
|
||||||
|
|
||||||
// format output
|
// format output
|
||||||
var flagFormat = flag.String("fmt", "text", "Set output format. Valid options are: json, csv of text")
|
var flagFormat = flag.String("fmt", "text", "Set output format. Valid options are: json, csv of text")
|
||||||
|
@ -99,7 +99,7 @@ func main() {
|
||||||
}
|
}
|
||||||
|
|
||||||
// Setup analyzer
|
// Setup analyzer
|
||||||
analyzer := gas.NewAnalyzer(*flagNoSec, logger)
|
analyzer := gas.NewAnalyzer(*flagIgnoreNoSec, logger)
|
||||||
if !rules.overwritten {
|
if !rules.overwritten {
|
||||||
rules.useDefaults()
|
rules.useDefaults()
|
||||||
}
|
}
|
||||||
|
|
60
rules/nosec_test.go
Normal file
60
rules/nosec_test.go
Normal file
|
@ -0,0 +1,60 @@
|
||||||
|
// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
package rules
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
gas "github.com/HewlettPackard/gas/core"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestNosec(t *testing.T) {
|
||||||
|
analyzer := gas.NewAnalyzer(false, nil)
|
||||||
|
analyzer.AddRule(NewSubproc())
|
||||||
|
|
||||||
|
issues := gasTestRunner(
|
||||||
|
`package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
)
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
cmd := exec.Command("sh", "-c", config.Command) // #nosec
|
||||||
|
}`, analyzer)
|
||||||
|
|
||||||
|
checkTestResults(t, issues, 0, "None")
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestNosecBlock(t *testing.T) {
|
||||||
|
analyzer := gas.NewAnalyzer(false, nil)
|
||||||
|
analyzer.AddRule(NewSubproc())
|
||||||
|
|
||||||
|
issues := gasTestRunner(
|
||||||
|
`package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
)
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
// #nosec
|
||||||
|
if true {
|
||||||
|
cmd := exec.Command("sh", "-c", config.Command)
|
||||||
|
}
|
||||||
|
}`, analyzer)
|
||||||
|
|
||||||
|
checkTestResults(t, issues, 0, "None")
|
||||||
|
}
|
Loading…
Reference in a new issue