1
0
mirror of https://github.com/securego/gosec.git synced 2025-12-01 22:41:54 +02:00

Try to resolve all elements in an expression to a known const

This is used in the subprocess launching test but will be added to
others as applicable.

This also closes #28
This commit is contained in:
Tim Kelsey
2016-08-03 14:54:17 +01:00
parent 12d370b11b
commit d2d49f1c8c
4 changed files with 111 additions and 10 deletions

View File

@@ -15,10 +15,11 @@
package rules
import (
gas "github.com/HewlettPackard/gas/core"
"go/ast"
"regexp"
"strings"
gas "github.com/HewlettPackard/gas/core"
)
type Subprocess struct {
@@ -27,10 +28,8 @@ type Subprocess struct {
func (r *Subprocess) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
if node := gas.MatchCall(n, r.pattern); node != nil {
// call with variable command or arguments
for _, arg := range node.Args {
if _, test := arg.(*ast.BasicLit); !test {
// TODO: try to resolve the symbol ...
if !gas.TryResolve(arg, c) {
what := "Subprocess launching with variable."
return gas.NewIssue(c, n, what, gas.High, gas.High), nil
}
@@ -52,7 +51,7 @@ func (r *Subprocess) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
func NewSubproc() (r gas.Rule, n ast.Node) {
r = &Subprocess{
pattern: regexp.MustCompile(`^exec.Command$`),
pattern: regexp.MustCompile(`^exec\.Command|syscall\.Exec$`),
}
n = (*ast.CallExpr)(nil)
return