actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-11-05 19:45:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fileperms: bitwise permission comparison (#883)

Browse source 
* fileperms: extract existing mode comparison logic

* fileperms: add failing test

* fileperms: bitwise permission comparison
This commit is contained in:
pro-wh 2022-10-19 23:48:40 -07:00 committed by GitHub
parent 1af1d5bb49
commit cf63541008
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
rules/fileperms.go
View file

@ -50,11 +50,15 @@ func getConfiguredMode(conf map[string]interface{}, configKey string, defaultMod
return mode return mode
} }
func modeIsSubset(subset int64, superset int64) bool {
return (subset | superset) == superset
}
func (r *filePermissions) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) { func (r *filePermissions) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) {
for _, pkg := range r.pkgs { for _, pkg := range r.pkgs {
if callexpr, matched := gosec.MatchCallByPackage(n, c, pkg, r.calls...); matched { if callexpr, matched := gosec.MatchCallByPackage(n, c, pkg, r.calls...); matched {
modeArg := callexpr.Args[len(callexpr.Args)-1] modeArg := callexpr.Args[len(callexpr.Args)-1]
if mode, err := gosec.GetInt(modeArg); err == nil && mode > r.mode { if mode, err := gosec.GetInt(modeArg); err == nil && !modeIsSubset(mode, r.mode) {
return gosec.NewIssue(c, n, r.ID(), r.What, r.Severity, r.Confidence), nil return gosec.NewIssue(c, n, r.ID(), r.What, r.Severity, r.Confidence), nil
} }
} }

15
rules/fileperms_test.go Normal file
View file

@ -0,0 +1,15 @@
package rules
import (
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
)
var _ = Describe("modeIsSubset", func() {
It("it compares modes correctly", func() {
Expect(modeIsSubset(0o600, 0o600)).To(BeTrue())
Expect(modeIsSubset(0o400, 0o600)).To(BeTrue())
Expect(modeIsSubset(0o644, 0o600)).To(BeFalse())
Expect(modeIsSubset(0o466, 0o600)).To(BeFalse())
})
})