diff --git a/core/analyzer.go b/core/analyzer.go
index 41904aa..0fa8a48 100644
--- a/core/analyzer.go
+++ b/core/analyzer.go
@@ -142,12 +142,14 @@ func (gas *Analyzer) process(filename string, source interface{}) error {
// AddRule adds a rule into a rule set list mapped to the given AST node's type.
// The node is only needed for its type and is not otherwise used.
-func (gas *Analyzer) AddRule(r Rule, n ast.Node) {
- t := reflect.TypeOf(n)
- if val, ok := gas.ruleset[t]; ok {
- gas.ruleset[t] = append(val, r)
- } else {
- gas.ruleset[t] = []Rule{r}
+func (gas *Analyzer) AddRule(r Rule, nodes []ast.Node) {
+ for _, n := range nodes {
+ t := reflect.TypeOf(n)
+ if val, ok := gas.ruleset[t]; ok {
+ gas.ruleset[t] = append(val, r)
+ } else {
+ gas.ruleset[t] = []Rule{r}
+ }
}
}
diff --git a/rulelist.go b/rulelist.go
index 61ea56f..0c207af 100644
--- a/rulelist.go
+++ b/rulelist.go
@@ -23,7 +23,7 @@ import (
type RuleInfo struct {
description string
- build func(map[string]interface{}) (gas.Rule, ast.Node)
+ build func(map[string]interface{}) (gas.Rule, []ast.Node)
}
// GetFullRuleList get the full list of all rules available to GAS
diff --git a/rules/bind.go b/rules/bind.go
index 4363684..c2fa781 100644
--- a/rules/bind.go
+++ b/rules/bind.go
@@ -39,8 +39,8 @@ func (r *BindsToAllNetworkInterfaces) Match(n ast.Node, c *gas.Context) (gi *gas
return
}
-func NewBindsToAllNetworkInterfaces(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &BindsToAllNetworkInterfaces{
+func NewBindsToAllNetworkInterfaces(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &BindsToAllNetworkInterfaces{
call: regexp.MustCompile(`^net\.Listen$`),
pattern: regexp.MustCompile(`^(0.0.0.0|:).*$`),
MetaData: gas.MetaData{
@@ -48,7 +48,5 @@ func NewBindsToAllNetworkInterfaces(conf map[string]interface{}) (r gas.Rule, n
Confidence: gas.High,
What: "Binds to all network interfaces",
},
- }
- n = (*ast.CallExpr)(nil)
- return
+ }, []ast.Node{(*ast.CallExpr)(nil)}
}
diff --git a/rules/blacklist.go b/rules/blacklist.go
index f3ceb39..747eb4b 100644
--- a/rules/blacklist.go
+++ b/rules/blacklist.go
@@ -34,54 +34,46 @@ func (r *BlacklistImport) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err
return nil, nil
}
-func NewBlacklist_crypto_md5(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &BlacklistImport{
+func NewBlacklist_crypto_md5(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &BlacklistImport{
MetaData: gas.MetaData{
Severity: gas.High,
Confidence: gas.High,
What: "Use of weak cryptographic primitive",
},
Path: `"crypto/md5"`,
- }
- n = (*ast.ImportSpec)(nil)
- return
+ }, []ast.Node{(*ast.ImportSpec)(nil)}
}
-func NewBlacklist_crypto_des(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &BlacklistImport{
+func NewBlacklist_crypto_des(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &BlacklistImport{
MetaData: gas.MetaData{
Severity: gas.High,
Confidence: gas.High,
What: "Use of weak cryptographic primitive",
},
Path: `"crypto/des"`,
- }
- n = (*ast.ImportSpec)(nil)
- return
+ }, []ast.Node{(*ast.ImportSpec)(nil)}
}
-func NewBlacklist_crypto_rc4(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &BlacklistImport{
+func NewBlacklist_crypto_rc4(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &BlacklistImport{
MetaData: gas.MetaData{
Severity: gas.High,
Confidence: gas.High,
What: "Use of weak cryptographic primitive",
},
Path: `"crypto/rc4"`,
- }
- n = (*ast.ImportSpec)(nil)
- return
+ }, []ast.Node{(*ast.ImportSpec)(nil)}
}
-func NewBlacklist_net_http_cgi(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &BlacklistImport{
+func NewBlacklist_net_http_cgi(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &BlacklistImport{
MetaData: gas.MetaData{
Severity: gas.High,
Confidence: gas.High,
- What: "Go code running under CGI is vulnerable to Httpoxy attack. (CVE-2016-5386)",
+ What: "Go versions < 1.6.3 are vulnerable to Httpoxy attack: (CVE-2016-5386)",
},
Path: `"net/http/cgi"`,
- }
- n = (*ast.ImportSpec)(nil)
- return
+ }, []ast.Node{(*ast.ImportSpec)(nil)}
}
diff --git a/rules/errors.go b/rules/errors.go
index 8d74634..4490312 100644
--- a/rules/errors.go
+++ b/rules/errors.go
@@ -50,14 +50,12 @@ func (r *NoErrorCheck) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err err
return nil, nil
}
-func NewNoErrorCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &NoErrorCheck{
+func NewNoErrorCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &NoErrorCheck{
MetaData: gas.MetaData{
Severity: gas.Low,
Confidence: gas.High,
What: "Errors unhandled.",
},
- }
- n = (*ast.AssignStmt)(nil)
- return
+ }, []ast.Node{(*ast.AssignStmt)(nil)}
}
diff --git a/rules/fileperms.go b/rules/fileperms.go
index 061876d..9a812cb 100644
--- a/rules/fileperms.go
+++ b/rules/fileperms.go
@@ -52,7 +52,7 @@ func (r *FilePermissions) Match(n ast.Node, c *gas.Context) (*gas.Issue, error)
return nil, nil
}
-func NewFilePerms(conf map[string]interface{}) (gas.Rule, ast.Node) {
+func NewFilePerms(conf map[string]interface{}) (gas.Rule, []ast.Node) {
mode := getConfiguredMode(conf, "G302", 0600)
return &FilePermissions{
mode: mode,
@@ -63,10 +63,10 @@ func NewFilePerms(conf map[string]interface{}) (gas.Rule, ast.Node) {
Confidence: gas.High,
What: fmt.Sprintf("Expect file permissions to be %#o or less", mode),
},
- }, (*ast.CallExpr)(nil)
+ }, []ast.Node{(*ast.CallExpr)(nil)}
}
-func NewMkdirPerms(conf map[string]interface{}) (gas.Rule, ast.Node) {
+func NewMkdirPerms(conf map[string]interface{}) (gas.Rule, []ast.Node) {
mode := getConfiguredMode(conf, "G301", 0700)
return &FilePermissions{
mode: mode,
@@ -77,5 +77,5 @@ func NewMkdirPerms(conf map[string]interface{}) (gas.Rule, ast.Node) {
Confidence: gas.High,
What: fmt.Sprintf("Expect directory permissions to be %#o or less", mode),
},
- }, (*ast.CallExpr)(nil)
+ }, []ast.Node{(*ast.CallExpr)(nil)}
}
diff --git a/rules/httpoxy_test.go b/rules/httpoxy_test.go
index 758389f..690794e 100644
--- a/rules/httpoxy_test.go
+++ b/rules/httpoxy_test.go
@@ -32,5 +32,5 @@ func TestHttpoxy(t *testing.T) {
)
func main() {}`, analyzer)
- checkTestResults(t, issues, 1, "Go code running under CGI is vulnerable to Httpoxy attack.")
+ checkTestResults(t, issues, 1, "Go versions < 1.6.3 are vulnerable to Httpoxy")
}
diff --git a/rules/rand.go b/rules/rand.go
index 54b6e6c..47ac55d 100644
--- a/rules/rand.go
+++ b/rules/rand.go
@@ -34,8 +34,8 @@ func (w *WeakRand) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
return nil, nil
}
-func NewWeakRandCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &WeakRand{
+func NewWeakRandCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &WeakRand{
funcName: "Read",
packagePath: "math/rand",
MetaData: gas.MetaData{
@@ -43,7 +43,5 @@ func NewWeakRandCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
Confidence: gas.Medium,
What: "Use of weak random number generator (math/rand instead of crypto/rand)",
},
- }
- n = (*ast.CallExpr)(nil)
- return
+ }, []ast.Node{(*ast.CallExpr)(nil)}
}
diff --git a/rules/rsa.go b/rules/rsa.go
index 5872186..510ca78 100644
--- a/rules/rsa.go
+++ b/rules/rsa.go
@@ -37,9 +37,9 @@ func (w *WeakKeyStrength) Match(n ast.Node, c *gas.Context) (*gas.Issue, error)
return nil, nil
}
-func NewWeakKeyStrength(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
+func NewWeakKeyStrength(conf map[string]interface{}) (gas.Rule, []ast.Node) {
bits := 2048
- r = &WeakKeyStrength{
+ return &WeakKeyStrength{
pattern: regexp.MustCompile(`^rsa\.GenerateKey$`),
bits: bits,
MetaData: gas.MetaData{
@@ -47,7 +47,5 @@ func NewWeakKeyStrength(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
Confidence: gas.High,
What: fmt.Sprintf("RSA keys should be at least %d bits", bits),
},
- }
- n = (*ast.CallExpr)(nil)
- return
+ }, []ast.Node{(*ast.CallExpr)(nil)}
}
diff --git a/rules/sql.go b/rules/sql.go
index 18483d6..10db0a2 100644
--- a/rules/sql.go
+++ b/rules/sql.go
@@ -56,8 +56,8 @@ func (s *SqlStrConcat) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
return nil, nil
}
-func NewSqlStrConcat(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &SqlStrConcat{
+func NewSqlStrConcat(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &SqlStrConcat{
SqlStatement: SqlStatement{
pattern: regexp.MustCompile(`(?)(SELECT|DELETE|INSERT|UPDATE|INTO|FROM|WHERE) `),
MetaData: gas.MetaData{
@@ -66,9 +66,7 @@ func NewSqlStrConcat(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
What: "SQL string concatenation",
},
},
- }
- n = (*ast.BinaryExpr)(nil)
- return
+ }, []ast.Node{(*ast.BinaryExpr)(nil)}
}
type SqlStrFormat struct {
@@ -86,8 +84,8 @@ func (s *SqlStrFormat) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err err
return nil, nil
}
-func NewSqlStrFormat(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &SqlStrFormat{
+func NewSqlStrFormat(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &SqlStrFormat{
call: regexp.MustCompile(`^fmt\.Sprintf$`),
SqlStatement: SqlStatement{
pattern: regexp.MustCompile("(?)(SELECT|DELETE|INSERT|UPDATE|INTO|FROM|WHERE) "),
@@ -97,7 +95,5 @@ func NewSqlStrFormat(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
What: "SQL string formatting",
},
},
- }
- n = (*ast.CallExpr)(nil)
- return
+ }, []ast.Node{(*ast.CallExpr)(nil)}
}
diff --git a/rules/subproc.go b/rules/subproc.go
index 991bbe2..b5a6fa2 100644
--- a/rules/subproc.go
+++ b/rules/subproc.go
@@ -49,10 +49,8 @@ func (r *Subprocess) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
return nil, nil
}
-func NewSubproc(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &Subprocess{
+func NewSubproc(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &Subprocess{
pattern: regexp.MustCompile(`^exec\.Command|syscall\.Exec$`),
- }
- n = (*ast.CallExpr)(nil)
- return
+ }, []ast.Node{(*ast.CallExpr)(nil)}
}
diff --git a/rules/tempfiles.go b/rules/tempfiles.go
index 7ca7570..3d2f49e 100644
--- a/rules/tempfiles.go
+++ b/rules/tempfiles.go
@@ -36,8 +36,8 @@ func (t *BadTempFile) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err erro
return nil, nil
}
-func NewBadTempFile(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &BadTempFile{
+func NewBadTempFile(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &BadTempFile{
call: regexp.MustCompile(`ioutil\.WriteFile|os\.Create`),
args: regexp.MustCompile(`^/tmp/.*$|^/var/tmp/.*$`),
MetaData: gas.MetaData{
@@ -45,7 +45,5 @@ func NewBadTempFile(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
Confidence: gas.High,
What: "File creation in shared tmp directory without using ioutil.Tempfile",
},
- }
- n = (*ast.CallExpr)(nil)
- return
+ }, []ast.Node{(*ast.CallExpr)(nil)}
}
diff --git a/rules/templates.go b/rules/templates.go
index 6b06a63..0f1dc24 100644
--- a/rules/templates.go
+++ b/rules/templates.go
@@ -37,15 +37,13 @@ func (t *TemplateCheck) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err er
return nil, nil
}
-func NewTemplateCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &TemplateCheck{
+func NewTemplateCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &TemplateCheck{
call: regexp.MustCompile(`^template\.(HTML|JS|URL)$`),
MetaData: gas.MetaData{
Severity: gas.Medium,
Confidence: gas.Low,
What: "this method will not auto-escape HTML. Verify data is well formed.",
},
- }
- n = (*ast.CallExpr)(nil)
- return
+ }, []ast.Node{(*ast.CallExpr)(nil)}
}
diff --git a/rules/tls.go b/rules/tls.go
index 301d3d9..c95fa58 100644
--- a/rules/tls.go
+++ b/rules/tls.go
@@ -109,9 +109,9 @@ func (t *InsecureConfigTLS) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, er
return
}
-func NewModernTlsCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
+func NewModernTlsCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
// https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
- r = &InsecureConfigTLS{
+ return &InsecureConfigTLS{
pattern: regexp.MustCompile(`^tls\.Config$`),
MinVersion: 0x0303, // TLS 1.2 only
MaxVersion: 0x0303,
@@ -121,14 +121,12 @@ func NewModernTlsCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
},
- }
- n = (*ast.CompositeLit)(nil)
- return
+ }, []ast.Node{(*ast.CompositeLit)(nil)}
}
-func NewIntermediateTlsCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
+func NewIntermediateTlsCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
// https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29
- r = &InsecureConfigTLS{
+ return &InsecureConfigTLS{
pattern: regexp.MustCompile(`^tls\.Config$`),
MinVersion: 0x0301, // TLS 1.2, 1.1, 1.0
MaxVersion: 0x0303,
@@ -149,14 +147,12 @@ func NewIntermediateTlsCheck(conf map[string]interface{}) (r gas.Rule, n ast.Nod
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
},
- }
- n = (*ast.CompositeLit)(nil)
- return
+ }, []ast.Node{(*ast.CompositeLit)(nil)}
}
-func NewCompatTlsCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
+func NewCompatTlsCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
// https://wiki.mozilla.org/Security/Server_Side_TLS#Old_compatibility_.28default.29
- r = &InsecureConfigTLS{
+ return &InsecureConfigTLS{
pattern: regexp.MustCompile(`^tls\.Config$`),
MinVersion: 0x0301, // TLS 1.2, 1.1, 1.0
MaxVersion: 0x0303,
@@ -179,7 +175,5 @@ func NewCompatTlsCheck(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
},
- }
- n = (*ast.CompositeLit)(nil)
- return
+ }, []ast.Node{(*ast.CompositeLit)(nil)}
}
diff --git a/rules/unsafe.go b/rules/unsafe.go
index 381f31f..3110727 100644
--- a/rules/unsafe.go
+++ b/rules/unsafe.go
@@ -15,10 +15,9 @@
package rules
import (
+ gas "github.com/GoASTScanner/gas/core"
"go/ast"
"regexp"
-
- gas "github.com/GoASTScanner/gas/core"
)
type UsingUnsafe struct {
@@ -33,15 +32,13 @@ func (r *UsingUnsafe) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err erro
return nil, nil
}
-func NewUsingUnsafe(conf map[string]interface{}) (r gas.Rule, n ast.Node) {
- r = &UsingUnsafe{
+func NewUsingUnsafe(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+ return &UsingUnsafe{
pattern: regexp.MustCompile(`unsafe\..*`),
MetaData: gas.MetaData{
What: "Use of unsafe calls should be audited",
Severity: gas.Low,
Confidence: gas.High,
},
- }
- n = (*ast.CallExpr)(nil)
- return
+ }, []ast.Node{(*ast.CallExpr)(nil)}
}
diff --git a/rules/weakcrypto.go b/rules/weakcrypto.go
index a10de70..1c859e9 100644
--- a/rules/weakcrypto.go
+++ b/rules/weakcrypto.go
@@ -36,7 +36,7 @@ func (r *UsesWeakCryptography) Match(n ast.Node, c *gas.Context) (*gas.Issue, er
}
// Uses des.* md5.* or rc4.*
-func NewUsesWeakCryptography(conf map[string]interface{}) (gas.Rule, ast.Node) {
+func NewUsesWeakCryptography(conf map[string]interface{}) (gas.Rule, []ast.Node) {
calls := make(map[string][]string)
calls["crypto/des"] = []string{"NewCipher", "NewTripleDESCipher"}
calls["crypto/md5"] = []string{"New", "Sum"}
@@ -49,5 +49,5 @@ func NewUsesWeakCryptography(conf map[string]interface{}) (gas.Rule, ast.Node) {
What: "Use of weak cryptographic primitive",
},
}
- return rule, (*ast.CallExpr)(nil)
+ return rule, []ast.Node{(*ast.CallExpr)(nil)}
}