From eb256a7d7065433accc7a719fbae6849b282931c Mon Sep 17 00:00:00 2001
From: Cosmin Cojocar <cosmin@cojocar.ch>
Date: Thu, 30 Nov 2023 17:42:44 +0100
Subject: [PATCH] Ignore the issues from generated files when using the
 analysis framework (#1079)

Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
---
 analyzer.go      | 23 +++++++++++++++++++++++
 analyzer_test.go | 48 ++++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 69 insertions(+), 2 deletions(-)

diff --git a/analyzer.go b/analyzer.go
index 304f4a2..0b1225b 100644
--- a/analyzer.go
+++ b/analyzer.go
@@ -414,6 +414,9 @@ func (gosec *Analyzer) CheckAnalyzers(pkg *packages.Package) {
 			SSA:    ssaResult.(*buildssa.SSA),
 		},
 	}
+
+	generatedFiles := gosec.generatedFiles(pkg)
+
 	for _, analyzer := range gosec.analyzerList {
 		pass := &analysis.Pass{
 			Analyzer:          analyzer,
@@ -441,6 +444,11 @@ func (gosec *Analyzer) CheckAnalyzers(pkg *packages.Package) {
 		if result != nil {
 			if passIssues, ok := result.([]*issue.Issue); ok {
 				for _, iss := range passIssues {
+					if gosec.excludeGenerated {
+						if _, ok := generatedFiles[iss.File]; ok {
+							continue
+						}
+					}
 					gosec.updateIssues(iss)
 				}
 			}
@@ -448,6 +456,21 @@ func (gosec *Analyzer) CheckAnalyzers(pkg *packages.Package) {
 	}
 }
 
+func (gosec *Analyzer) generatedFiles(pkg *packages.Package) map[string]bool {
+	generatedFiles := map[string]bool{}
+	for _, file := range pkg.Syntax {
+		if isGeneratedFile(file) {
+			fp := pkg.Fset.File(file.Pos())
+			if fp == nil {
+				// skip files which cannot be located
+				continue
+			}
+			generatedFiles[fp.Name()] = true
+		}
+	}
+	return generatedFiles
+}
+
 // buildSSA runs the SSA pass which builds the SSA representation of the package. It handles gracefully any panic.
 func (gosec *Analyzer) buildSSA(pkg *packages.Package) (interface{}, error) {
 	defer func() {
diff --git a/analyzer_test.go b/analyzer_test.go
index 792b514..5d8b947 100644
--- a/analyzer_test.go
+++ b/analyzer_test.go
@@ -471,7 +471,7 @@ var _ = Describe("Analyzer", func() {
 			issues, _, _ := customAnalyzer.Report()
 			Expect(issues).Should(HaveLen(1))
 		})
-		It("should be able to scan generated files if NOT excluded", func() {
+		It("should be able to scan generated files if NOT excluded when using the rules", func() {
 			customAnalyzer := gosec.NewAnalyzer(nil, true, false, false, 1, logger)
 			customAnalyzer.LoadRules(rules.Generate(false).RulesInfo())
 			pkg := testutils.NewTestPackage()
@@ -492,7 +492,7 @@ var _ = Describe("Analyzer", func() {
 			issues, _, _ := customAnalyzer.Report()
 			Expect(issues).Should(HaveLen(1))
 		})
-		It("should be able to skip generated files if excluded", func() {
+		It("should be able to skip generated files if excluded when using the rules", func() {
 			customAnalyzer := gosec.NewAnalyzer(nil, true, true, false, 1, logger)
 			customAnalyzer.LoadRules(rules.Generate(false).RulesInfo())
 			pkg := testutils.NewTestPackage()
@@ -513,6 +513,50 @@ var _ = Describe("Analyzer", func() {
 			issues, _, _ := customAnalyzer.Report()
 			Expect(issues).Should(BeEmpty())
 		})
+		It("should be able to scan generated files if NOT excluded when using the analyzes", func() {
+			customAnalyzer := gosec.NewAnalyzer(nil, true, false, false, 1, logger)
+			customAnalyzer.LoadRules(rules.Generate(false).RulesInfo())
+			pkg := testutils.NewTestPackage()
+			defer pkg.Close()
+			pkg.AddFile("foo.go", `
+				package main
+				// Code generated some-generator DO NOT EDIT.
+        import (
+          "fmt"
+        )
+        func main() {
+          values := []string{}
+          fmt.Println(values[0])
+				}`)
+			err := pkg.Build()
+			Expect(err).ShouldNot(HaveOccurred())
+			err = customAnalyzer.Process(buildTags, pkg.Path)
+			Expect(err).ShouldNot(HaveOccurred())
+			issues, _, _ := customAnalyzer.Report()
+			Expect(issues).Should(HaveLen(1))
+		})
+		It("should be able to skip generated files if excluded when using the analyzes", func() {
+			customAnalyzer := gosec.NewAnalyzer(nil, true, true, false, 1, logger)
+			customAnalyzer.LoadRules(rules.Generate(false).RulesInfo())
+			pkg := testutils.NewTestPackage()
+			defer pkg.Close()
+			pkg.AddFile("foo.go", `
+				package main
+				// Code generated some-generator DO NOT EDIT.
+        import (
+          "fmt"
+        )
+        func main() {
+          values := []string{}
+          fmt.Println(values[0])
+				}`)
+			err := pkg.Build()
+			Expect(err).ShouldNot(HaveOccurred())
+			err = customAnalyzer.Process(buildTags, pkg.Path)
+			Expect(err).ShouldNot(HaveOccurred())
+			issues, _, _ := customAnalyzer.Report()
+			Expect(issues).Should(BeEmpty())
+		})
 	})
 	It("should be able to analyze Cgo files", func() {
 		analyzer.LoadRules(rules.Generate(false).RulesInfo())