Parsing error in windows

[cyw3]

Summary

gosec does not work in windows.

Steps to reproduce the behavior

gosec F:/data/...

• in linux, it work.
• but in windows, failed:

 Including rules: default
 [gosec] 2019/06/13 11:34:09 Excluding rules: default
[gosec] 2019/06/13 11:34:09 Import directory: F:\data\src\back_media
[gosec] 2019/06/13 11:35:17 Checking package: main
[gosec] 2019/06/13 11:35:17 Checking file: F:\data\src\back_media\back_media.go
[gosec] 2019/06/13 11:35:17 Checking file: F:\data\src\back_media\main.go
[gosec] 2019/06/13 11:35:17 Import directory: F:\data\src\cdnutil
 [gosec] 2019/06/13 11:35:23 parsing errors in pkg "cdnutil": parsing line: strconv.Atoi: parsing "\\data\\src\\cdnutil\\ref_api.go": invalid syntax

gosec version

2.0.0

Go version (output of 'go version')

1.12.6

Operating system / Environment

windows 7
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\xxx\AppData\Local\go-build
set GOEXE=.exe
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOOS=windows
set GOPATH=F:\tools\go-1.12.6\go
set GOPROXY=
set GORACE=
set GOROOT=F:\tools\go-1.12.6
set GOTMPDIR=
set GOTOOLDIR=F:\tools\go-1.12.6\pkg\tool\windows_amd64
set GCCGO=gccgo
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused-arguments -fmessag
e-length=0 -fdebug-prefix-map=C:\Users\codedog\AppData\Local\Temp\go-build106690
454=/tmp/go-build -gno-record-gcc-switches

Expected behavior

output result.

Actual behavior

parsing errors in pkg "cdnutil"

[gcmurphy]

gosec is using the go toolchain and this looks like a compiler error to me not a gosec error. Are you sure that this package builds on windows?

What happens if you do a go build . within the cdnutils directory?

[cyw3]

So, gosec will build the code file when it scan the codebase?

[gcmurphy]

Yes. We tried to make this error more clear via #284 so syntax errors are reported separately.

Example file:

▶ cat main.go 
package main

import (
	"fmt"
	"os"
)

func main() {
	fmt.Println("vim-go")
}

This file doesn't compile:

go build main.go 
# command-line-arguments
./main.go:5:2: imported and not used: "os"

Running the current master branch of gosec on it:

./gosec ~/go/src/github.com/gcmurphy/example
[gosec] 2019/06/14 10:50:42 Including rules: default
[gosec] 2019/06/14 10:50:42 Excluding rules: default
[gosec] 2019/06/14 10:50:42 Import directory: /Users/grantmurphy/go/src/github.com/gcmurphy/example
[gosec] 2019/06/14 10:50:43 Checking package: main
[gosec] 2019/06/14 10:50:43 Checking file: /Users/grantmurphy/go/src/github.com/gcmurphy/example/main.go
Results:

Golang errors in file: [/Users/grantmurphy/go/src/github.com/gcmurphy/example/main.go]:
  > [line 5 : column 2] - "os" imported but not used

Summary:
   Files: 1
   Lines: 10
   Nosec: 0
  Issues: 0

[JohnnyQQQQ]

I'm experiencing the same issue after installing gosec on windows using go get -u github.com/securego/gosec. My golang version is go1.12.4 windows/amd64.

The binary of the project I run gosec against builds fine.

[ccojocar]

@JohnnyQQQQ Do you use modules, and are they enabled? What exactly is the error?

[JohnnyQQQQ]

@ccojocar ah snap, I missed to set GO111MODULE to on, sorry for the noise. Thanks for the catch!

[JohnnyQQQQ]

Now I get the error a bit later, it's a bigger project.

[gosec] 2019/06/24 21:42:32 parsing errors in pkg "main": parsing line: strconv.Atoi: parsing "\\Users\\Jean-Philippe\\Desktop\\Projects\\my-tests\\go\\messaging\\test-ends\\simulate-feedback.go": invalid syntax

[ccojocar]

@JohnnyQQQQ Any chance to attach these files which you are trying to scan?

[JohnnyQQQQ]

@ccojocar no, unfortunately not

[gcmurphy]

Without a concise reproducer I'm not sure how we can move forward on this bug, and TBH I don't think gosec is doing anything special here. It should effectively be just using the golang toolchain to build your project.

I'm going to close this for now but I you can figure out a small example that you can share with us please feel free to reopen this issue.

[jim-liu]

I recently ran into a similar issue. In my case the go file uses something from syscall that is Linux only. Running gosec on the same code on Linux went through without errors.

The code below should repro the issue:

package main

import (
    "fmt"
    "syscall"
)

func main() {
    pid, _, _ := syscall.Syscall(syscall.SYS_GETPID, 0, 0, 0)
    fmt.Println("process id: ", pid)
}