actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-12-24 11:35:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

rand: use a MatchCallByPackage helper

Browse source
This commit is contained in:
Tommy Murphy 2016-11-06 12:31:12 -05:00
parent 8a473c7e4b
commit afb84ff20c
No known key found for this signature in database
GPG key ID: BAD1E06818CE9067
2 changed files with 7 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
core/helpers.go
View file

@ -52,11 +52,11 @@ func MatchCall(n ast.Node, r *regexp.Regexp) *ast.CallExpr {
// package and identifier name matches the passed in parameters.
//
// Usage:
// node, obj := MatchCall(n, ctx, "math/rand", "Read")
// node, obj := MatchCallByPackage(n, ctx, "math/rand", "Read")
//
func MatchCallByObject(n ast.Node, c *Context, pkg, name string) (*ast.CallExpr, types.Object) {
func MatchCallByPackage(n ast.Node, c *Context, pkg, name string) (*ast.CallExpr, types.Object) {
call, obj := GetCallObject(n, c)
if obj != nil && obj.Pkg().Path() == pkg && obj.Name() == name {
if obj != nil && obj.Pkg() != nil && obj.Pkg().Path() == pkg && obj.Name() == name {
return call, obj
}
return nil, nil

38
rules/rand.go
View file

@ -16,50 +16,20 @@ package rules
import (
"go/ast"
"go/types"
"regexp"
gas "github.com/GoASTScanner/gas/core"
)
type WeakRand struct {
gas.MetaData
pattern *regexp.Regexp
funcName string
packagePath string
}
func matchFuncCall(n ast.Node, c *gas.Context) (types.Object, *ast.Ident) {
call, ok := n.(*ast.CallExpr)
if !ok {
return nil, nil
}
sel, ok := call.Fun.(*ast.SelectorExpr)
if !ok {
return nil, nil
}
id, ok := sel.X.(*ast.Ident)
if !ok {
return nil, nil
}
return c.Info.ObjectOf(id), sel.Sel
}
func (w *WeakRand) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
o, f := matchFuncCall(n, c)
node, _ := gas.MatchCallByPackage(n, c, w.packagePath, w.funcName)
if o == nil || f == nil {
return nil, nil
}
pkg, ok := o.(*types.PkgName)
if !ok {
return nil, nil
}
if pkg.Imported().Path() == w.packagePath && w.pattern.MatchString(f.String()) {
if node != nil {
return gas.NewIssue(c, n, w.What, w.Severity, w.Confidence), nil
}
@ -68,7 +38,7 @@ func (w *WeakRand) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
func NewWeakRandCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
r = &WeakRand{
pattern: regexp.MustCompile(`^Read$`),
funcName: "Read",
packagePath: "math/rand",
MetaData: gas.MetaData{
Severity: gas.High,