diff --git a/rules/decompression-bomb.go b/rules/decompression-bomb.go index bfc5897..02256fa 100644 --- a/rules/decompression-bomb.go +++ b/rules/decompression-bomb.go @@ -95,6 +95,7 @@ func NewDecompressionBombCheck(id string, conf gosec.Config) (gosec.Rule, []ast. copyCalls := gosec.NewCallList() copyCalls.Add("io", "Copy") + copyCalls.Add("io", "CopyBuffer") return &decompressionBombCheck{ MetaData: gosec.MetaData{ diff --git a/testutils/source.go b/testutils/source.go index 20c0b20..ee69766 100644 --- a/testutils/source.go +++ b/testutils/source.go @@ -699,12 +699,40 @@ func main() { if err != nil { panic(err) } - io.Copy(os.Stdout, r) + _, err := io.Copy(os.Stdout, r) + if err != nil { + panic(err) + } r.Close() }`}, 1, gosec.NewConfig()}, {[]string{` package main +import ( + "bytes" + "compress/zlib" + "io" + "os" +) + +func main() { + buff := []byte{120, 156, 202, 72, 205, 201, 201, 215, 81, 40, 207, + 47, 202, 73, 225, 2, 4, 0, 0, 255, 255, 33, 231, 4, 147} + b := bytes.NewReader(buff) + + r, err := zlib.NewReader(b) + if err != nil { + panic(err) + } + buf := make([]byte, 8) + _, err := io.CopyBuffer(os.Stdout, r, buf) + if err != nil { + panic(err) + } + r.Close() +}`}, 1, gosec.NewConfig()}, {[]string{` +package main + import ( "archive/zip" "io"