mirror of
https://github.com/securego/gosec.git
synced 2024-12-28 21:08:22 +02:00
0ae0174c25
The existing code assumed imports to be either imported, or imported with an
alias. Badly formatted files may have duplicate imports for a package, using
different aliases.
This patch refactors the code, and;
Introduces a new `GetImportedNames` function, which returns all name(s) and
aliase(s) for a package, which effectively combines `GetAliasedName` and
`GetImportedName`, but adding support for duplicate imports.
The old `GetAliasedName` and `GetImportedName` functions have been rewritten to
use the new function and marked deprecated, but could be removed if there are no
external consumers.
With this patch, the linter is able to detect issues in files such as;
package main
import (
crand "crypto/rand"
"math/big"
"math/rand"
rand2 "math/rand"
rand3 "math/rand"
)
func main() {
_, _ = crand.Int(crand.Reader, big.NewInt(int64(2))) // good
_ = rand.Intn(2) // bad
_ = rand2.Intn(2) // bad
_ = rand3.Intn(2) // bad
}
Before this patch, only a single issue would be detected:
gosec --quiet .
[main.go:14] - G404 (CWE-338): Use of weak random number generator (math/rand instead of crypto/rand) (Confidence: MEDIUM, Severity: HIGH)
13:
> 14: _ = rand.Intn(2) // bad
15: _ = rand2.Intn(2) // bad
With this patch, all issues are identified:
gosec --quiet .
[main.go:16] - G404 (CWE-338): Use of weak random number generator (math/rand instead of crypto/rand) (Confidence: MEDIUM, Severity: HIGH)
15: _ = rand2.Intn(2) // bad
> 16: _ = rand3.Intn(2) // bad
17: }
[main.go:15] - G404 (CWE-338): Use of weak random number generator (math/rand instead of crypto/rand) (Confidence: MEDIUM, Severity: HIGH)
14: _ = rand.Intn(2) // bad
> 15: _ = rand2.Intn(2) // bad
16: _ = rand3.Intn(2) // bad
[main.go:14] - G404 (CWE-338): Use of weak random number generator (math/rand instead of crypto/rand) (Confidence: MEDIUM, Severity: HIGH)
13:
> 14: _ = rand.Intn(2) // bad
15: _ = rand2.Intn(2) // bad
While working on this change, I noticed that ImportTracker.TrackFile() was not able
to find import aliases; Analyser.Check() called both ImportTracker.TrackFile() and
ast.Walk(), which (with the updated ImportTracker) resulted in importes to be in-
correctly included multiple times (once with the correct alias, once with the default).
I updated ImportTracker.TrackFile() to fix this, but with the updated ImportTracker,
Analyser.Check() no longer has to call ImportTracker.TrackFile() separately, as ast.Walk()
already handles the file, and will find all imports.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
73 lines
2.1 KiB
Go
73 lines
2.1 KiB
Go
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package gosec
|
|
|
|
import (
|
|
"go/ast"
|
|
"go/types"
|
|
"strings"
|
|
)
|
|
|
|
// ImportTracker is used to normalize the packages that have been imported
|
|
// by a source file. It is able to differentiate between plain imports, aliased
|
|
// imports and init only imports.
|
|
type ImportTracker struct {
|
|
// Imported is a map of Imported with their associated names/aliases.
|
|
Imported map[string][]string
|
|
}
|
|
|
|
// NewImportTracker creates an empty Import tracker instance
|
|
func NewImportTracker() *ImportTracker {
|
|
return &ImportTracker{
|
|
Imported: make(map[string][]string),
|
|
}
|
|
}
|
|
|
|
// TrackFile track all the imports used by the supplied file
|
|
func (t *ImportTracker) TrackFile(file *ast.File) {
|
|
for _, imp := range file.Imports {
|
|
t.TrackImport(imp)
|
|
}
|
|
}
|
|
|
|
// TrackPackages tracks all the imports used by the supplied packages
|
|
func (t *ImportTracker) TrackPackages(pkgs ...*types.Package) {
|
|
for _, pkg := range pkgs {
|
|
t.Imported[pkg.Path()] = []string{pkg.Name()}
|
|
}
|
|
}
|
|
|
|
// TrackImport tracks imports.
|
|
func (t *ImportTracker) TrackImport(imported *ast.ImportSpec) {
|
|
importPath := strings.Trim(imported.Path.Value, `"`)
|
|
if imported.Name != nil {
|
|
if imported.Name.Name == "_" {
|
|
// Initialization only import
|
|
} else {
|
|
// Aliased import
|
|
t.Imported[importPath] = append(t.Imported[importPath], imported.Name.String())
|
|
}
|
|
} else {
|
|
t.Imported[importPath] = append(t.Imported[importPath], importName(importPath))
|
|
}
|
|
}
|
|
|
|
func importName(importPath string) string {
|
|
parts := strings.Split(importPath, "/")
|
|
name := importPath
|
|
if len(parts) > 0 {
|
|
name = parts[len(parts)-1]
|
|
}
|
|
return name
|
|
}
|