go/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2025-11-25 22:22:17 +02:00
Code Issues Releases Activity

Fix the bind rule to handle the case when the arguments of the net.Listen are returned by a function call

Browse Source
This commit is contained in:
Cosmin Cojocar
2018-12-02 15:37:42 +01:00
committed by Cosmin Cojocar
parent f14f17fb1d
commit 9b32fcac16
2 changed files with 51 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
rules/bind.go
View File

@@ -37,9 +37,21 @@ func (r *bindsToAllNetworkInterfaces) Match(n ast.Node, c *gosec.Context) (*gose
if callExpr == nil {
return nil, nil
}
if arg, err := gosec.GetString(callExpr.Args[1]); err == nil {
if r.pattern.MatchString(arg) {
return gosec.NewIssue(c, n, r.ID(), r.What, r.Severity, r.Confidence), nil
if len(callExpr.Args) > 1 {
arg := callExpr.Args[1]
if bl, ok := arg.(*ast.BasicLit); ok {
if arg, err := gosec.GetString(bl); err == nil {
if r.pattern.MatchString(arg) {
return gosec.NewIssue(c, n, r.ID(), r.What, r.Severity, r.Confidence), nil
}
}
}
} else if len(callExpr.Args) > 0 {
values := gosec.GetCallStringArgsValues(callExpr.Args[0], c)
for _, value := range values {
if r.pattern.MatchString(value) {
return gosec.NewIssue(c, n, r.ID(), r.What, r.Severity, r.Confidence), nil
}
}
}
return nil, nil