Skip to content

Commit 103c429

Browse files
mmorel-35mmorel-35
authored
Enable golangcli and improve testing for formatters
1 parent 4df7f1c commit 103c429

18 files changed

+755
-336
lines changed

‎.github/workflows/ci.yml

+10
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,16 @@ on:
77
branches:
88
- master
99
jobs:
10+
golangci:
11+
name: lint
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v2
15+
- name: golangci-lint
16+
uses: golangci/golangci-lint-action@v2
17+
continue-on-error: true
18+
with:
19+
version: latest
1020
tests-go-1-16:
1121
runs-on: ubuntu-latest
1222
env:

‎.golangci.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
linters:
2+
enable:
3+
- megacheck
4+
- govet
5+
- unparam
6+
- unconvert
7+
- misspell
8+
- gofmt
9+
- golint
10+
- gosec
11+
- nakedret
12+
- dogsled
13+
- depguard

‎cwe/cwe_suite_test.go

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package cwe_test
2+
3+
import (
4+
. "github.com/onsi/ginkgo"
5+
. "github.com/onsi/gomega"
6+
7+
"testing"
8+
)
9+
10+
func TestCwe(t *testing.T) {
11+
RegisterFailHandler(Fail)
12+
RunSpecs(t, "Cwe Suite")
13+
}

‎cwe/data.go

+124-101
Original file line numberDiff line numberDiff line change
@@ -1,106 +1,129 @@
11
package cwe
22

3-
var data = map[string]*Weakness{
4-
"118": {
5-
ID: "118",
6-
Description: "The software does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.",
7-
Name: "Incorrect Access of Indexable Resource ('Range Error')",
8-
},
9-
"190": {
10-
ID: "190",
11-
Description: "The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.",
12-
Name: "Integer Overflow or Wraparound",
13-
},
14-
"200": {
15-
ID: "200",
16-
Description: "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.",
17-
Name: "Exposure of Sensitive Information to an Unauthorized Actor",
18-
},
19-
"22": {
20-
ID: "22",
21-
Description: "The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.",
22-
Name: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
23-
},
24-
"242": {
25-
ID: "242",
26-
Description: "The program calls a function that can never be guaranteed to work safely.",
27-
Name: "Use of Inherently Dangerous Function",
28-
},
29-
"276": {
30-
ID: "276",
31-
Description: "During installation, installed file permissions are set to allow anyone to modify those files.",
32-
Name: "Incorrect Default Permissions",
33-
},
34-
"295": {
35-
ID: "295",
36-
Description: "The software does not validate, or incorrectly validates, a certificate.",
37-
Name: "Improper Certificate Validation",
38-
},
39-
"310": {
40-
ID: "310",
41-
Description: "Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.",
42-
Name: "Cryptographic Issues",
43-
},
44-
"322": {
45-
ID: "322",
46-
Description: "The software performs a key exchange with an actor without verifying the identity of that actor.",
47-
Name: "Key Exchange without Entity Authentication",
48-
},
49-
"326": {
50-
ID: "326",
51-
Description: "The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.",
52-
Name: "Inadequate Encryption Strength",
53-
},
54-
"327": {
55-
ID: "327",
56-
Description: "The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.",
57-
Name: "Use of a Broken or Risky Cryptographic Algorithm",
58-
},
59-
"338": {
60-
ID: "338",
61-
Description: "The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.",
62-
Name: "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
63-
},
64-
"377": {
65-
ID: "377",
66-
Description: "Creating and using insecure temporary files can leave application and system data vulnerable to attack.",
67-
Name: "Insecure Temporary File",
68-
},
69-
"409": {
70-
ID: "409",
71-
Description: "The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.",
72-
Name: "Improper Handling of Highly Compressed Data (Data Amplification)",
73-
},
74-
"703": {
75-
ID: "703",
76-
Description: "The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.",
77-
Name: "Improper Check or Handling of Exceptional Conditions",
78-
},
79-
"78": {
80-
ID: "78",
81-
Description: "The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.",
82-
Name: "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
83-
},
84-
"79": {
85-
ID: "79",
86-
Description: "The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.",
87-
Name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
88-
},
89-
"798": {
90-
ID: "798",
91-
Description: "The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.",
92-
Name: "Use of Hard-coded Credentials",
93-
},
94-
"88": {
95-
ID: "88",
96-
Description: "The software constructs a string for a command to executed by a separate component\nin another control sphere, but it does not properly delimit the\nintended arguments, options, or switches within that command string.",
97-
Name: "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')",
98-
},
99-
"89": {
100-
ID: "89",
101-
Description: "The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.",
102-
Name: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
103-
},
3+
const (
4+
//Acronym is the acronym of CWE
5+
Acronym = "CWE"
6+
//Version the CWE version
7+
Version = "4.4"
8+
//ReleaseDateUtc the release Date of CWE Version
9+
ReleaseDateUtc = "2021-03-15"
10+
//Organization MITRE
11+
Organization = "MITRE"
12+
//Description the description of CWE
13+
Description = "The MITRE Common Weakness Enumeration"
14+
)
15+
16+
var (
17+
data = map[string]*Weakness{}
18+
19+
weaknesses = []*Weakness{
20+
{
21+
ID: "118",
22+
Description: "The software does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.",
23+
Name: "Incorrect Access of Indexable Resource ('Range Error')",
24+
},
25+
{
26+
ID: "190",
27+
Description: "The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.",
28+
Name: "Integer Overflow or Wraparound",
29+
},
30+
{
31+
ID: "200",
32+
Description: "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.",
33+
Name: "Exposure of Sensitive Information to an Unauthorized Actor",
34+
},
35+
{
36+
ID: "22",
37+
Description: "The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.",
38+
Name: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
39+
},
40+
{
41+
ID: "242",
42+
Description: "The program calls a function that can never be guaranteed to work safely.",
43+
Name: "Use of Inherently Dangerous Function",
44+
},
45+
{
46+
ID: "276",
47+
Description: "During installation, installed file permissions are set to allow anyone to modify those files.",
48+
Name: "Incorrect Default Permissions",
49+
},
50+
{
51+
ID: "295",
52+
Description: "The software does not validate, or incorrectly validates, a certificate.",
53+
Name: "Improper Certificate Validation",
54+
},
55+
{
56+
ID: "310",
57+
Description: "Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.",
58+
Name: "Cryptographic Issues",
59+
},
60+
{
61+
ID: "322",
62+
Description: "The software performs a key exchange with an actor without verifying the identity of that actor.",
63+
Name: "Key Exchange without Entity Authentication",
64+
},
65+
{
66+
ID: "326",
67+
Description: "The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.",
68+
Name: "Inadequate Encryption Strength",
69+
},
70+
{
71+
ID: "327",
72+
Description: "The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.",
73+
Name: "Use of a Broken or Risky Cryptographic Algorithm",
74+
},
75+
{
76+
ID: "338",
77+
Description: "The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.",
78+
Name: "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
79+
},
80+
{
81+
ID: "377",
82+
Description: "Creating and using insecure temporary files can leave application and system data vulnerable to attack.",
83+
Name: "Insecure Temporary File",
84+
},
85+
{
86+
ID: "409",
87+
Description: "The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.",
88+
Name: "Improper Handling of Highly Compressed Data (Data Amplification)",
89+
},
90+
{
91+
ID: "703",
92+
Description: "The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.",
93+
Name: "Improper Check or Handling of Exceptional Conditions",
94+
},
95+
{
96+
ID: "78",
97+
Description: "The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.",
98+
Name: "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
99+
},
100+
{
101+
ID: "79",
102+
Description: "The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.",
103+
Name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
104+
},
105+
{
106+
ID: "798",
107+
Description: "The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.",
108+
Name: "Use of Hard-coded Credentials",
109+
},
110+
{
111+
ID: "88",
112+
Description: "The software constructs a string for a command to executed by a separate component\nin another control sphere, but it does not properly delimit the\nintended arguments, options, or switches within that command string.",
113+
Name: "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')",
114+
},
115+
{
116+
ID: "89",
117+
Description: "The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.",
118+
Name: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
119+
},
120+
}
121+
)
122+
123+
func init() {
124+
for _, weakness := range weaknesses {
125+
data[weakness.ID] = weakness
126+
}
104127
}
105128

106129
//Get Retrieves a CWE weakness by it's id

‎cwe/data_test.go

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
package cwe_test
2+
3+
import (
4+
. "github.com/onsi/ginkgo"
5+
. "github.com/onsi/gomega"
6+
"github.com/securego/gosec/v2/cwe"
7+
)
8+
9+
var _ = Describe("CWE data", func() {
10+
BeforeEach(func() {
11+
})
12+
Context("when consulting cwe data", func() {
13+
It("it should retrieves the weakness", func() {
14+
weakness := cwe.Get("798")
15+
Expect(weakness).ShouldNot(BeNil())
16+
Expect(weakness.ID).ShouldNot(BeNil())
17+
Expect(weakness.Name).ShouldNot(BeNil())
18+
Expect(weakness.Description).ShouldNot(BeNil())
19+
})
20+
21+
})
22+
})

‎cwe/types.go

+11-8
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,6 @@ import (
55
"fmt"
66
)
77

8-
const (
9-
//URL is the base URL for CWE definitions
10-
URL = "https://cwe.mitre.org/data/definitions/"
11-
//Acronym is the acronym of CWE
12-
Acronym = "CWE"
13-
)
14-
158
// Weakness defines a CWE weakness based on http://cwe.mitre.org/data/xsd/cwe_schema_v6.4.xsd
169
type Weakness struct {
1710
ID string
@@ -21,7 +14,7 @@ type Weakness struct {
2114

2215
//SprintURL format the CWE URL
2316
func (w *Weakness) SprintURL() string {
24-
return fmt.Sprintf("%s%s.html", URL, w.ID)
17+
return fmt.Sprintf("https://cwe.mitre.org/data/definitions/%s.html", w.ID)
2518
}
2619

2720
//SprintID format the CWE ID
@@ -39,3 +32,13 @@ func (w *Weakness) MarshalJSON() ([]byte, error) {
3932
URL: w.SprintURL(),
4033
})
4134
}
35+
36+
//InformationURI link to the published CWE PDF
37+
func InformationURI() string {
38+
return fmt.Sprintf("https://cwe.mitre.org/data/published/cwe_v%s.pdf/", Version)
39+
}
40+
41+
//DownloadURI link to the zipped XML of the CWE list
42+
func DownloadURI() string {
43+
return fmt.Sprintf("https://cwe.mitre.org/data/xml/cwec_v%s.xml.zip", Version)
44+
}

‎cwe/types_test.go

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package cwe_test
2+
3+
import (
4+
. "github.com/onsi/ginkgo"
5+
. "github.com/onsi/gomega"
6+
"github.com/securego/gosec/v2/cwe"
7+
)
8+
9+
var _ = Describe("CWE Types", func() {
10+
BeforeEach(func() {
11+
})
12+
Context("when consulting cwe types", func() {
13+
It("it should retrieves the information and download URIs", func() {
14+
Expect(cwe.InformationURI()).To(Equal("https://cwe.mitre.org/data/published/cwe_v4.4.pdf/"))
15+
Expect(cwe.DownloadURI()).To(Equal("https://cwe.mitre.org/data/xml/cwec_v4.4.xml.zip"))
16+
})
17+
18+
It("it should retrieves the weakness ID and URL", func() {
19+
weakness := &cwe.Weakness{ID: "798"}
20+
Expect(weakness).ShouldNot(BeNil())
21+
Expect(weakness.SprintID()).To(Equal("CWE-798"))
22+
Expect(weakness.SprintURL()).To(Equal("https://cwe.mitre.org/data/definitions/798.html"))
23+
})
24+
})
25+
})

‎report/formatter_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@ var _ = Describe("Formatter", func() {
294294
Expect(err).ShouldNot(HaveOccurred())
295295
pattern := "/home/src/project/test.go,1,test,HIGH,HIGH,1: testcode,CWE-%s\n"
296296
expect := fmt.Sprintf(pattern, cwe.ID)
297-
Expect(string(buf.String())).To(Equal(expect))
297+
Expect(buf.String()).To(Equal(expect))
298298
}
299299
})
300300
It("xml formatted report should contain the CWE mapping", func() {
@@ -308,7 +308,7 @@ var _ = Describe("Formatter", func() {
308308
Expect(err).ShouldNot(HaveOccurred())
309309
pattern := "Results:\n\n\n[/home/src/project/test.go:1] - %s (CWE-%s): test (Confidence: HIGH, Severity: HIGH)\n > 1: testcode\n\n\n\nSummary:\n Files: 0\n Lines: 0\n Nosec: 0\n Issues: 0\n\n"
310310
expect := fmt.Sprintf(pattern, rule, cwe.ID)
311-
Expect(string(buf.String())).To(Equal(expect))
311+
Expect(buf.String()).To(Equal(expect))
312312
}
313313
})
314314
It("json formatted report should contain the CWE mapping", func() {
@@ -442,7 +442,7 @@ var _ = Describe("Formatter", func() {
442442
Expect(err).ShouldNot(HaveOccurred())
443443
pattern := "/home/src/project/test.go:1:1: [CWE-%s] test (Rule:%s, Severity:HIGH, Confidence:HIGH)\n"
444444
expect := fmt.Sprintf(pattern, cwe.ID, rule)
445-
Expect(string(buf.String())).To(Equal(expect))
445+
Expect(buf.String()).To(Equal(expect))
446446
}
447447
})
448448
It("sarif formatted report should contain the CWE mapping", func() {

0 commit comments

Comments
 (0)