go/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2025-12-01 22:41:54 +02:00
Code Issues Releases Activity

Find more tempdirs

Browse Source 
* Find G303 in string concatenations, with os.TempDir, and in path.Join args

* Find G303 with /usr/tmp, too

/usr/tmp is commonly found e.g. on Solaris.
This commit is contained in:
Ville Skyttä
2022-01-03 22:58:25 +02:00
committed by GitHub
parent 827fca9a83
commit 19bda8d15f
2 changed files with 57 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
rules/tempfiles.go
View File

@@ -23,19 +23,41 @@ import (
type badTempFile struct {
gosec.MetaData
calls gosec.CallList
args *regexp.Regexp
calls gosec.CallList
args *regexp.Regexp
argCalls gosec.CallList
nestedCalls gosec.CallList
}
func (t *badTempFile) ID() string {
return t.MetaData.ID
}
func (t *badTempFile) findTempDirArgs(n ast.Node, c *gosec.Context, suspect ast.Node) *gosec.Issue {
if s, e := gosec.GetString(suspect); e == nil {
if t.args.MatchString(s) {
return gosec.NewIssue(c, n, t.ID(), t.What, t.Severity, t.Confidence)
}
return nil
}
if ce := t.argCalls.ContainsPkgCallExpr(suspect, c, false); ce != nil {
return gosec.NewIssue(c, n, t.ID(), t.What, t.Severity, t.Confidence)
}
if be, ok := suspect.(*ast.BinaryExpr); ok {
if ops := gosec.GetBinaryExprOperands(be); len(ops) != 0 {
return t.findTempDirArgs(n, c, ops[0])
}
return nil
}
if ce := t.nestedCalls.ContainsPkgCallExpr(suspect, c, false); ce != nil {
return t.findTempDirArgs(n, c, ce.Args[0])
}
return nil
}
func (t *badTempFile) Match(n ast.Node, c *gosec.Context) (gi *gosec.Issue, err error) {
if node := t.calls.ContainsPkgCallExpr(n, c, false); node != nil {
if arg, e := gosec.GetString(node.Args[0]); t.args.MatchString(arg) && e == nil {
return gosec.NewIssue(c, n, t.ID(), t.What, t.Severity, t.Confidence), nil
}
return t.findTempDirArgs(n, c, node.Args[0]), nil
}
return nil, nil
}
@@ -45,9 +67,15 @@ func NewBadTempFile(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
calls := gosec.NewCallList()
calls.Add("io/ioutil", "WriteFile")
calls.AddAll("os", "Create", "WriteFile")
argCalls := gosec.NewCallList()
argCalls.Add("os", "TempDir")
nestedCalls := gosec.NewCallList()
nestedCalls.Add("path", "Join")
return &badTempFile{
calls: calls,
args: regexp.MustCompile(`^/tmp/.*$|^/var/tmp/.*$`),
calls: calls,
args: regexp.MustCompile(`^(/(usr|var))?/tmp(/.*)?$`),
argCalls: argCalls,
nestedCalls: nestedCalls,
MetaData: gosec.MetaData{
ID: id,
Severity: gosec.Medium,