actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-11-05 19:45:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #86 from GoASTScanner/experimental

Browse source 
Handle inbalanced declaration of constants
This commit is contained in:
Grant Murphy 2016-11-14 15:20:54 -08:00 committed by GitHub
commit 6ef59ba3ae
2 changed files with 37 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
rules/hardcoded_credentials.go
View file

@ -58,7 +58,11 @@ func (r *Credentials) matchGenDecl(decl *ast.GenDecl, ctx *gas.Context) (*gas.Is
for _, spec := range decl.Specs {
if valueSpec, ok := spec.(*ast.ValueSpec); ok {
for index, ident := range valueSpec.Names {
if r.pattern.MatchString(ident.Name) {
if r.pattern.MatchString(ident.Name) && valueSpec.Values != nil {
// const foo, bar = "same value"
if len(valueSpec.Values) <= index {
index = len(valueSpec.Values) - 1
}
if _, ok := valueSpec.Values[index].(*ast.BasicLit); ok {
return gas.NewIssue(ctx, decl, r.What, r.Severity, r.Confidence), nil
}

32
rules/hardcoded_credentials_test.go
View file

@ -79,3 +79,35 @@ func TestHardcodedConstant(t *testing.T) {
checkTestResults(t, issues, 1, "Potential hardcoded credentials")
}
func TestHardcodedConstantMulti(t *testing.T) {
config := map[string]interface{}{"ignoreNosec": false}
analyzer := gas.NewAnalyzer(config, nil)
analyzer.AddRule(NewHardcodedCredentials(config))
issues := gasTestRunner(`
package samples
import "fmt"
const username, password = "secret"
func main() {
fmt.Println("Doing something with: ", username, password)
}`, analyzer)
checkTestResults(t, issues, 1, "Potential hardcoded credentials")
}
func TestHardecodedVarsNotAssigned(t *testing.T) {
config := map[string]interface{}{"ignoreNosec": false}
analyzer := gas.NewAnalyzer(config, nil)
analyzer.AddRule(NewHardcodedCredentials(config))
issues := gasTestRunner(`
package main
var password string
func init() {
password = "this is a secret string"
}`, analyzer)
checkTestResults(t, issues, 1, "Potential hardcoded credentials")
}