1
0
mirror of https://github.com/securego/gosec.git synced 2025-07-07 00:35:35 +02:00

Fix the rule G304 to handle the case when the input is cleaned as a variable assignment

Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
This commit is contained in:
Cosmin Cojocar
2020-08-17 21:05:28 +02:00
parent b60ddc21ba
commit 047729a84f
2 changed files with 57 additions and 2 deletions

View File

@ -1586,7 +1586,42 @@ func main() {
log.Printf("Error: %v\n", err)
}
log.Print(body)
}`}, 1, gosec.NewConfig()}}
}`}, 1, gosec.NewConfig()}, {[]string{`
package main
import (
"os"
"path/filepath"
)
func main() {
repoFile := "path_of_file"
cleanRepoFile := filepath.Clean(repoFile)
byContext, err := os.OpenFile(cleanRepoFile, os.O_RDONLY, 0600)
if err != nil {
panic(err)
}
}
`}, 0, gosec.NewConfig()}, {[]string{`
package main
import (
"os"
"path/filepath"
)
func openFile(filePath string) {
byContext, err := os.OpenFile(filepath.Clean(filePath), os.O_RDONLY, 0600)
if err != nil {
panic(err)
}
}
func main() {
repoFile := "path_of_file"
openFile(repoFile)
}
`}, 0, gosec.NewConfig()}}
// SampleCodeG305 - File path traversal when extracting zip/tar archives
SampleCodeG305 = []CodeSample{{[]string{`