mirror of
https://github.com/securego/gosec.git
synced 2026-06-20 00:15:59 +02:00
Ravi Sastry Kadali
553d8a5050
Update README and DEVELOPMENT to list G707-G710 alongside the existing taint rules. Add CWE-444 for G113 (HTTP request smuggling) and CWE-276 for G307 (os.Create permissions) so issues from those rules carry a CWE weakness instead of nil. Fix a 'falg1' typo in flag_test that prevented the validated-flag test from binding the flag it was meant to exercise.
46 lines
1.4 KiB
Go
46 lines
1.4 KiB
Go
package gosec_test
|
|
|
|
import (
|
|
"flag"
|
|
"os"
|
|
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
|
|
"github.com/securego/gosec/v2/cmd/vflag"
|
|
)
|
|
|
|
var _ = Describe("Cli", func() {
|
|
Context("vflag test", func() {
|
|
It("value must be empty as parameter value contains invalid character", func() {
|
|
os.Args = []string{"gosec", "-flag1=-incorrect"}
|
|
f := vflag.ValidatedFlag{}
|
|
flag.CommandLine = flag.NewFlagSet(os.Args[0], flag.ContinueOnError)
|
|
flag.Var(&f, "flag1", "")
|
|
flag.CommandLine.Init("flag1", flag.ContinueOnError)
|
|
flag.Parse()
|
|
Expect(flag.Parsed()).Should(BeTrue())
|
|
Expect(f.Value).Should(Equal(``))
|
|
})
|
|
It("value must be empty as parameter value contains invalid character without equal sign", func() {
|
|
os.Args = []string{"gosec", "-test2= -incorrect"}
|
|
f := vflag.ValidatedFlag{}
|
|
flag.CommandLine = flag.NewFlagSet(os.Args[0], flag.ContinueOnError)
|
|
flag.Var(&f, "test2", "")
|
|
flag.CommandLine.Init("test2", flag.ContinueOnError)
|
|
flag.Parse()
|
|
Expect(flag.Parsed()).Should(BeTrue())
|
|
Expect(f.Value).Should(Equal(``))
|
|
})
|
|
It("value must not be empty as parameter value contains valid character", func() {
|
|
os.Args = []string{"gosec", "-test3=correct"}
|
|
f := vflag.ValidatedFlag{}
|
|
flag.Var(&f, "test3", "")
|
|
flag.CommandLine.Init("test3", flag.ContinueOnError)
|
|
flag.Parse()
|
|
Expect(flag.Parsed()).Should(BeTrue())
|
|
Expect(f.Value).Should(Equal(`correct`))
|
|
})
|
|
})
|
|
})
|