Refactor to support duplicate imports with different aliases (#865)

The existing code assumed imports to be either imported, or imported with an
alias. Badly formatted files may have duplicate imports for a package, using
different aliases.

This patch refactors the code, and;

Introduces a new `GetImportedNames` function, which returns all name(s) and
aliase(s) for a package, which effectively combines `GetAliasedName` and
`GetImportedName`, but adding support for duplicate imports.

The old `GetAliasedName` and `GetImportedName` functions have been rewritten to
use the new function and marked deprecated, but could be removed if there are no
external consumers.

With this patch, the linter is able to detect issues in files such as;

    package main

    import (
        crand "crypto/rand"
        "math/big"
        "math/rand"
        rand2 "math/rand"
        rand3 "math/rand"
    )

    func main() {
        _, _ = crand.Int(crand.Reader, big.NewInt(int64(2))) // good

        _ = rand.Intn(2) // bad
        _ = rand2.Intn(2)  // bad
        _ = rand3.Intn(2)  // bad
    }

Before this patch, only a single issue would be detected:

    gosec --quiet .

    [main.go:14] - G404 (CWE-338): Use of weak random number generator (math/rand instead of crypto/rand) (Confidence: MEDIUM, Severity: HIGH)
        13:
      > 14: 	_ = rand.Intn(2) // bad
        15: 	_ = rand2.Intn(2)  // bad

With this patch, all issues are identified:

    gosec --quiet .

    [main.go:16] - G404 (CWE-338): Use of weak random number generator (math/rand instead of crypto/rand) (Confidence: MEDIUM, Severity: HIGH)
        15: 	_ = rand2.Intn(2)  // bad
      > 16: 	_ = rand3.Intn(2)  // bad
        17: }

    [main.go:15] - G404 (CWE-338): Use of weak random number generator (math/rand instead of crypto/rand) (Confidence: MEDIUM, Severity: HIGH)
        14: 	_ = rand.Intn(2) // bad
      > 15: 	_ = rand2.Intn(2)  // bad
        16: 	_ = rand3.Intn(2)  // bad

    [main.go:14] - G404 (CWE-338): Use of weak random number generator (math/rand instead of crypto/rand) (Confidence: MEDIUM, Severity: HIGH)
        13:
      > 14: 	_ = rand.Intn(2) // bad
        15: 	_ = rand2.Intn(2)  // bad

While working on this change, I noticed that ImportTracker.TrackFile() was not able
to find import aliases;  Analyser.Check() called both ImportTracker.TrackFile() and
ast.Walk(), which (with the updated ImportTracker) resulted in importes to be in-
correctly included multiple times (once with the correct alias, once with the default).

I updated ImportTracker.TrackFile() to fix this, but with the updated ImportTracker,
Analyser.Check() no longer has to call ImportTracker.TrackFile() separately, as ast.Walk()
already handles the file, and will find all imports.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

import_tracker.go

@@ -22,54 +22,51 @@ import (
 // by a source file. It is able to differentiate between plain imports, aliased
 // imports and init only imports.
 type ImportTracker struct {
-	Imported map[string]string
-	Aliased  map[string]string
-	InitOnly map[string]bool
+	// Imported is a map of Imported with their associated names/aliases.
+	Imported map[string][]string
 }
 
 // NewImportTracker creates an empty Import tracker instance
 func NewImportTracker() *ImportTracker {
 	return &ImportTracker{
-		make(map[string]string),
-		make(map[string]string),
-		make(map[string]bool),
+		Imported: make(map[string][]string),
 	}
 }
 
 // TrackFile track all the imports used by the supplied file
 func (t *ImportTracker) TrackFile(file *ast.File) {
 	for _, imp := range file.Imports {
-		path := strings.Trim(imp.Path.Value, `"`)
-		parts := strings.Split(path, "/")
-		if len(parts) > 0 {
-			name := parts[len(parts)-1]
-			t.Imported[path] = name
-		}
+		t.TrackImport(imp)
 	}
 }
 
 // TrackPackages tracks all the imports used by the supplied packages
 func (t *ImportTracker) TrackPackages(pkgs ...*types.Package) {
 	for _, pkg := range pkgs {
-		t.Imported[pkg.Path()] = pkg.Name()
+		t.Imported[pkg.Path()] = []string{pkg.Name()}
 	}
 }
 
-// TrackImport tracks imports and handles the 'unsafe' import
-func (t *ImportTracker) TrackImport(n ast.Node) {
-	if imported, ok := n.(*ast.ImportSpec); ok {
-		path := strings.Trim(imported.Path.Value, `"`)
-		if imported.Name != nil {
-			if imported.Name.Name == "_" {
-				// Initialization only import
-				t.InitOnly[path] = true
-			} else {
-				// Aliased import
-				t.Aliased[path] = imported.Name.Name
-			}
-		}
-		if path == "unsafe" {
-			t.Imported[path] = path
+// TrackImport tracks imports.
+func (t *ImportTracker) TrackImport(imported *ast.ImportSpec) {
+	importPath := strings.Trim(imported.Path.Value, `"`)
+	if imported.Name != nil {
+		if imported.Name.Name == "_" {
+			// Initialization only import
+		} else {
+			// Aliased import
+			t.Imported[importPath] = append(t.Imported[importPath], imported.Name.String())
 		}
+	} else {
+		t.Imported[importPath] = append(t.Imported[importPath], importName(importPath))
 	}
 }
+
+func importName(importPath string) string {
+	parts := strings.Split(importPath, "/")
+	name := importPath
+	if len(parts) > 0 {
+		name = parts[len(parts)-1]
+	}
+	return name
+}