Merge pull request #129 from cosmincojocar/big_exp

Add a rule which audits the use of math/big.Int.Exp function call

README.md

@@ -36,6 +36,7 @@ or to specify a set of rules to explicitly exclude using the '-exclude=' flag.
   - G102: Bind to all interfaces
   - G103: Audit the use of unsafe block
   - G104: Audit errors not checked
+  - G105: Audit the use of math/big.Int.Exp
   - G201: SQL query construction using format string
   - G202: SQL query construction using string concatenation
   - G203: Use of unescaped data in HTML templates

rulelist.go

@@ -34,6 +34,7 @@ func GetFullRuleList() map[string]RuleInfo {
 		"G102": RuleInfo{"Bind to all interfaces", rules.NewBindsToAllNetworkInterfaces},
 		"G103": RuleInfo{"Audit the use of unsafe block", rules.NewUsingUnsafe},
 		"G104": RuleInfo{"Audit errors not checked", rules.NewNoErrorCheck},
+		"G105": RuleInfo{"Audit the use of big.Exp function", rules.NewUsingBigExp},
 
 		// injection
 		"G201": RuleInfo{"SQL query construction using format string", rules.NewSqlStrFormat},

rules/big.go

@@ -0,0 +1,44 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	gas "github.com/GoASTScanner/gas/core"
+	"go/ast"
+)
+
+type UsingBigExp struct {
+	gas.MetaData
+	pkg   string
+	calls []string
+}
+
+func (r *UsingBigExp) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if _, matched := gas.MatchCallByType(n, c, r.pkg, r.calls...); matched {
+		return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+	}
+	return nil, nil
+}
+func NewUsingBigExp(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &UsingBigExp{
+		pkg:   "*math/big.Int",
+		calls: []string{"Exp"},
+		MetaData: gas.MetaData{
+			What:       "Use of math/big.Int.Exp function should be audited for modulus == 0",
+			Severity:   gas.Low,
+			Confidence: gas.High,
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

rules/big_test.go

@@ -0,0 +1,49 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"testing"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+func TestBigExp(t *testing.T) {
+	config := map[string]interface{}{"ignoreNosec": false}
+	analyzer := gas.NewAnalyzer(config, nil)
+	analyzer.AddRule(NewUsingBigExp(config))
+
+	issues := gasTestRunner(`
+        package main
+
+        import (
+        	"math/big"
+        )
+
+        func main() {
+            z := new(big.Int)
+            x := new(big.Int)
+            x = x.SetUint64(2)
+            y := new(big.Int)
+            y = y.SetUint64(4)
+            m := new(big.Int)
+            m = m.SetUint64(0)
+
+            z = z.Exp(x, y, m)
+        }
+        `, analyzer)
+
+	checkTestResults(t, issues, 1, "Use of math/big.Int.Exp function")
+}