go/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2025-11-29 22:37:59 +02:00
Code Issues Releases Activity

feat: adds support for path.Join and for tar archives in G305

Browse Source
This commit is contained in:
ggkitsas
2020-08-02 16:09:02 +01:00
committed by Cosmin Cojocar
parent 673a139e55
commit b60ddc21ba
3 changed files with 86 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
rules/archive.go
View File

@@ -9,15 +9,15 @@ import (
type archive struct {
gosec.MetaData
calls gosec.CallList
argType string
calls gosec.CallList
argTypes []string
}
func (a *archive) ID() string {
return a.MetaData.ID
}
// Match inspects AST nodes to determine if the filepath.Joins uses any argument derived from type zip.File
// Match inspects AST nodes to determine if the filepath.Joins uses any argument derived from type zip.File or tar.Header
func (a *archive) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) {
if node := a.calls.ContainsPkgCallExpr(n, c, false); node != nil {
for _, arg := range node.Args {
@@ -35,26 +35,31 @@ func (a *archive) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) {
}
}
if argType != nil && argType.String() == a.argType {
return gosec.NewIssue(c, n, a.ID(), a.What, a.Severity, a.Confidence), nil
if argType != nil {
for _, t := range a.argTypes {
if argType.String() == t {
return gosec.NewIssue(c, n, a.ID(), a.What, a.Severity, a.Confidence), nil
}
}
}
}
}
return nil, nil
}
// NewArchive creates a new rule which detects the file traversal when extracting zip archives
// NewArchive creates a new rule which detects the file traversal when extracting zip/tar archives
func NewArchive(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
calls := gosec.NewCallList()
calls.Add("path/filepath", "Join")
calls.Add("path", "Join")
return &archive{
calls: calls,
argType: "*archive/zip.File",
calls: calls,
argTypes: []string{"*archive/zip.File", "*archive/tar.Header"},
MetaData: gosec.MetaData{
ID: id,
Severity: gosec.Medium,
Confidence: gosec.High,
What: "File traversal when extracting zip archive",
What: "File traversal when extracting zip/tar archive",
},
}, []ast.Node{(*ast.CallExpr)(nil)}
}