mirror of
https://github.com/securego/gosec.git
synced 2024-12-25 03:55:54 +00:00
Merge pull request #60 from tam7t/fix-rand
rand: resolve math/rand package
This commit is contained in:
commit
aadcf8dbdb
2 changed files with 59 additions and 10 deletions
|
@ -16,6 +16,7 @@ package rules
|
|||
|
||||
import (
|
||||
"go/ast"
|
||||
"go/types"
|
||||
"regexp"
|
||||
|
||||
gas "github.com/GoASTScanner/gas/core"
|
||||
|
@ -24,25 +25,50 @@ import (
|
|||
type WeakRand struct {
|
||||
gas.MetaData
|
||||
pattern *regexp.Regexp
|
||||
packageName string
|
||||
packagePath string
|
||||
}
|
||||
|
||||
func (w *WeakRand) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
|
||||
if call := gas.MatchCall(n, w.pattern); call != nil {
|
||||
for _, pkg := range c.Pkg.Imports() {
|
||||
if pkg.Name() == w.packageName && pkg.Path() == w.packagePath {
|
||||
return gas.NewIssue(c, n, w.What, w.Severity, w.Confidence), nil
|
||||
}
|
||||
}
|
||||
func matchFuncCall(n ast.Node, c *gas.Context) (types.Object, *ast.Ident) {
|
||||
call, ok := n.(*ast.CallExpr)
|
||||
if !ok {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
sel, ok := call.Fun.(*ast.SelectorExpr)
|
||||
if !ok {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
id, ok := sel.X.(*ast.Ident)
|
||||
if !ok {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
return c.Info.ObjectOf(id), sel.Sel
|
||||
}
|
||||
|
||||
func (w *WeakRand) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
|
||||
o, f := matchFuncCall(n, c)
|
||||
|
||||
if o == nil || f == nil {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
pkg, ok := o.(*types.PkgName)
|
||||
if !ok {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
if pkg.Imported().Path() == w.packagePath && w.pattern.MatchString(f.String()) {
|
||||
return gas.NewIssue(c, n, w.What, w.Severity, w.Confidence), nil
|
||||
}
|
||||
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func NewWeakRandCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
|
||||
r = &WeakRand{
|
||||
pattern: regexp.MustCompile(`^rand\.Read$`),
|
||||
packageName: "rand",
|
||||
pattern: regexp.MustCompile(`^Read$`),
|
||||
packagePath: "math/rand",
|
||||
MetaData: gas.MetaData{
|
||||
Severity: gas.High,
|
||||
|
|
|
@ -55,3 +55,26 @@ func TestRandBad(t *testing.T) {
|
|||
|
||||
checkTestResults(t, issues, 1, "Use of weak random number generator (math/rand instead of crypto/rand)")
|
||||
}
|
||||
|
||||
func TestRandRenamed(t *testing.T) {
|
||||
config := map[string]interface{}{"ignoreNosec": false}
|
||||
analyzer := gas.NewAnalyzer(config, nil)
|
||||
analyzer.AddRule(NewWeakRandCheck(config))
|
||||
|
||||
issues := gasTestRunner(
|
||||
`
|
||||
package samples
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
mrand "math/rand"
|
||||
)
|
||||
|
||||
|
||||
func main() {
|
||||
good, err := rand.Read(nil)
|
||||
i := mrand.Int()
|
||||
}`, analyzer)
|
||||
|
||||
checkTestResults(t, issues, 0, "Not expected to match")
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue