Fix false positives for SQL string concatenation with constants from another file

[wongherlung]

Fixes #169. Sorry, it's been a while, was busy with work. 😅

This PR aims to handle the following case:

main.go

package main

func main() {
  ...
  rows, err := db.Query("SELECT * FROM foo WHERE gender = " + gender)
  ...
}

constants.go (for example)

package main

...
const gender = "M"
...

Currently, gosec will flag this this out as an issue in main.go as the gender identifier is unresolved.

This PR will add pkg.Files to gosec.context so that we will be able to resolve that identifier if it happens to be in the global scope of that package.

[ccojocar]

It would be nice to have a test for this use case.

[wongherlung]

👍 I was thinking so too. But this test case spans across two files and I'm not sure how to do it. Let me try to figure it out.

[ccojocar]

I think you can extend the sample.Code to support multiple files. The test package is built here:

gosec/rules/rules_test.go

Line 35 in 5f98926

pkg.AddFile(fmt.Sprintf("sample_%d.go", n), sample.Code)

In this file are the code samples defined:
https://github.com/securego/gosec/blob/master/testutils/source.go

[wongherlung]

I added a new value to the CodeSample struct.

type CodeSample struct {
	Code           string
	Errors         int
	SupportingCode bool
}

Snippets that have it set to true will not be processed against the rules, but added to the same pkg as the other snippets to be processed together.

Not sure if this is this most elegant way to allow for testing with multiple files. Feedback will be welcomed!

[ccojocar]

Looks fine. You could have also use a Code []string. To keep multiple files. I will refactoring afterwards.

Thanks for providing the tests.

[wongherlung]

ahh yes. It's much better to use Code []string. If you are okay, can I help with the refactoring? for https://hacktoberfest.digitalocean.com/ 😂

[ccojocar]

I refactored it in the PR #248

[ccojocar]

Looks fine. You could have also use a Code []string. To keep multiple files. I will refactoring afterwards.

Thanks for providing the tests.