Skip to content

Commit f43a957

Browse files
rafaveira3ccojocar
rafaveira3
authored and
ccojocar
committed
Check for both default and alternative nosec tags (#426)
* Check both nosec tags * Adjust test to find vulnerabilities * Add a few alias in Makefile to get GOPATH
1 parent 79fbf3a commit f43a957

File tree

5 files changed

+37
-18
lines changed

5 files changed

+37
-18
lines changed

‎Makefile

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,27 +6,32 @@ BUILDFLAGS := '-w -s'
66
CGO_ENABLED = 0
77
GO := GO111MODULE=on go
88
GO_NOMOD :=GO111MODULE=off go
9+
GOPATH ?= $(shell $(GO) env GOPATH)
10+
GOBIN ?= $(GOPATH)/bin
11+
GOLINT ?= $(GOBIN)/golint
12+
GOSEC ?= $(GOBIN)/gosec
13+
GINKGO ?= $(GOBIN)/ginkgo
914

1015
default:
1116
$(MAKE) build
1217

1318
test: build fmt lint sec
1419
$(GO_NOMOD) get -u github.com/onsi/ginkgo/ginkgo
15-
ginkgo -r -v
20+
$(GINKGO) -r -v
1621

1722
fmt:
1823
@echo "FORMATTING"
1924
@FORMATTED=`$(GO) fmt ./...`
2025
@([[ ! -z "$(FORMATTED)" ]] && printf "Fixed unformatted files:\n$(FORMATTED)") || true
2126

22-
lint:
27+
lint:
2328
@echo "LINTING"
2429
$(GO_NOMOD) get -u golang.org/x/lint/golint
25-
golint -set_exit_status ./...
30+
$(GOLINT) -set_exit_status ./...
2631
@echo "VETTING"
27-
$(GO) vet ./...
32+
$(GO) vet ./...
2833

29-
sec:
34+
sec:
3035
@echo "SECURITY SCANNING"
3136
./$(BIN) ./...
3237

@@ -40,10 +45,10 @@ clean:
4045
rm -rf build vendor dist
4146
rm -f release image $(BIN)
4247

43-
release:
48+
release:
4449
@echo "Releasing the gosec binary..."
4550
goreleaser release
46-
51+
4752
build-linux:
4853
CGO_ENABLED=$(CGO_ENABLED) GOOS=linux GOARCH=amd64 go build -ldflags $(BUILDFLAGS) -o $(BIN) ./cmd/gosec/
4954

@@ -59,4 +64,3 @@ image-push: image
5964
docker push $(IMAGE_REPO)/$(BIN):latest
6065

6166
.PHONY: test build clean release image image-push
62-

‎analyzer.go

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -259,18 +259,23 @@ func (gosec *Analyzer) AppendError(file string, err error) {
259259
gosec.errors[file] = errors
260260
}
261261

262-
// ignore a node (and sub-tree) if it is tagged with a "#nosec" comment
262+
// ignore a node (and sub-tree) if it is tagged with a nosec tag comment
263263
func (gosec *Analyzer) ignore(n ast.Node) ([]string, bool) {
264264
if groups, ok := gosec.context.Comments[n]; ok && !gosec.ignoreNosec {
265265

266266
// Checks if an alternative for #nosec is set and, if not, uses the default.
267-
noSecAlternative, err := gosec.config.GetGlobal(NoSecAlternative)
267+
noSecDefaultTag := "#nosec"
268+
noSecAlternativeTag, err := gosec.config.GetGlobal(NoSecAlternative)
268269
if err != nil {
269-
noSecAlternative = "#nosec"
270+
noSecAlternativeTag = noSecDefaultTag
270271
}
271272

272273
for _, group := range groups {
273-
if strings.Contains(group.Text(), noSecAlternative) {
274+
275+
foundDefaultTag := strings.Contains(group.Text(), noSecDefaultTag)
276+
foundAlternativeTag := strings.Contains(group.Text(), noSecAlternativeTag)
277+
278+
if foundDefaultTag || foundAlternativeTag {
274279
gosec.stats.NumNosec++
275280

276281
// Pull out the specific rules that are listed to be ignored.

‎analyzer_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ var _ = Describe("Analyzer", func() {
265265

266266
})
267267

268-
It("should be possible to change the default #nosec directive to another one", func() {
268+
It("should be possible to use an alternative nosec tag", func() {
269269
// Rule for MD5 weak crypto usage
270270
sample := testutils.SampleCodeG401[0]
271271
source := sample.Code[0]
@@ -289,7 +289,7 @@ var _ = Describe("Analyzer", func() {
289289

290290
})
291291

292-
It("should not ignore vulnerabilities", func() {
292+
It("should ignore vulnerabilities when the default tag is found", func() {
293293
// Rule for MD5 weak crypto usage
294294
sample := testutils.SampleCodeG401[0]
295295
source := sample.Code[0]
@@ -309,7 +309,7 @@ var _ = Describe("Analyzer", func() {
309309
err = customAnalyzer.Process(buildTags, nosecPackage.Path)
310310
Expect(err).ShouldNot(HaveOccurred())
311311
nosecIssues, _, _ := customAnalyzer.Report()
312-
Expect(nosecIssues).Should(HaveLen(sample.Errors))
312+
Expect(nosecIssues).Should(HaveLen(0))
313313

314314
})
315315

‎go.mod

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,11 @@ require (
1111
github.com/onsi/gomega v1.8.1
1212
github.com/stretchr/objx v0.2.0 // indirect
1313
github.com/stretchr/testify v1.4.0 // indirect
14+
golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f // indirect
1415
golang.org/x/net v0.0.0-20190923162816-aa69164e4478 // indirect
1516
golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 // indirect
1617
golang.org/x/text v0.3.2 // indirect
17-
golang.org/x/tools v0.0.0-20200102140908-9497f49d5709
18+
golang.org/x/tools v0.0.0-20200103221440-774c71fcf114
1819
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
1920
gopkg.in/yaml.v2 v2.2.7
2021
)

‎go.sum

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,17 @@ github.com/onsi/ginkgo v1.8.0 h1:VkHVNpR4iVnU8XQR6DBm8BqYjN7CRzw+xKUbVVbbW9w=
2828
github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
2929
github.com/onsi/ginkgo v1.10.1 h1:q/mM8GF/n0shIN8SaAZ0V+jnLPzen6WIVZdiwrRlMlo=
3030
github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
31+
github.com/onsi/ginkgo v1.10.3 h1:OoxbjfXVZyod1fmWYhI7SEyaD8B00ynP3T+D5GiyHOY=
3132
github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
33+
github.com/onsi/ginkgo v1.11.0 h1:JAKSXpt1YjtLA7YpPiqO9ss6sNXEsPfSGdwN0UHqzrw=
3234
github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
3335
github.com/onsi/gomega v1.5.0 h1:izbySO9zDPmjJ8rDjLvkA2zJHIo+HkYXHnf7eN7SSyo=
3436
github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
3537
github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME=
3638
github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
39+
github.com/onsi/gomega v1.7.1 h1:K0jcRCwNQM3vFGh1ppMtDh/+7ApJrjldlX8fA0jDTLQ=
3740
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
41+
github.com/onsi/gomega v1.8.1 h1:C5Dqfs/LeauYDX0jJXIe2SWmwCbGzx9yF8C8xy3Lh34=
3842
github.com/onsi/gomega v1.8.1/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
3943
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
4044
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -52,7 +56,10 @@ golang.org/x/crypto v0.0.0-20190909091759-094676da4a83/go.mod h1:yigFU9vqHzYiE8U
5256
golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5357
golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392 h1:ACG4HJsFiNMf47Y4PeRoebLNy/2lXT9EtprMuTFWt1M=
5458
golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
59+
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
5560
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
61+
golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f h1:J5lckAjkw6qYlOZNj90mLYNTEKDvWeuc1yieZ8qUzUE=
62+
golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
5663
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
5764
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
5865
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -116,11 +123,13 @@ golang.org/x/tools v0.0.0-20190930201159-7c411dea38b0 h1:7+F62GGWUowoiJOUDivedlB
116123
golang.org/x/tools v0.0.0-20190930201159-7c411dea38b0/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
117124
golang.org/x/tools v0.0.0-20191101200257-8dbcdeb83d3f h1:+QO45yvqhfD79HVNFPAgvstYLFye8zA+rd0mHFsGV9s=
118125
golang.org/x/tools v0.0.0-20191101200257-8dbcdeb83d3f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
126+
golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
119127
golang.org/x/tools v0.0.0-20191217033636-bbbf87ae2631 h1:6/HU2wqgxuc1kG3FdVH8K60WlieDAlIYaVc21Cit9Us=
120128
golang.org/x/tools v0.0.0-20191217033636-bbbf87ae2631/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
121-
golang.org/x/tools v0.0.0-20200102140908-9497f49d5709 h1:AfG1EmoRkFK24HWWLxSrRKNg2G+oA3JVOG8GJsHWypQ=
122-
golang.org/x/tools v0.0.0-20200102140908-9497f49d5709/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
129+
golang.org/x/tools v0.0.0-20200103221440-774c71fcf114 h1:DnSr2mCsxyCE6ZgIkmcWUQY2R5cH/6wL7eIxEmQOMSE=
130+
golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
123131
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
132+
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898 h1:/atklqdjdhuosWIl6AIbOeHJjicWYPqR9bpxqxYG2pA=
124133
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
125134
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
126135
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=

0 commit comments

Comments
 (0)