Skip to content

Commit 0588031

Browse files
ldezuudashr
ldez
authored and
uudashr
committed
build(deps): bump github.com/securego/gosec/v2 from 5f0084eb01a9 to 81cda2f91fbe (golangci#4927)
1 parent 0af8104 commit 0588031

File tree

7 files changed

+84
-29
lines changed

7 files changed

+84
-29
lines changed

‎.golangci.next.reference.yml

+14-2
Original file line numberDiff line numberDiff line change
@@ -853,6 +853,7 @@ linters-settings:
853853
- G112 # Potential slowloris attack
854854
- G113 # Usage of Rat.SetString in math/big with an overflow (CVE-2022-23772)
855855
- G114 # Use of net/http serve function that has no support for setting timeouts
856+
- G115 # Potential integer overflow when converting between integer types
856857
- G201 # SQL query construction using format string
857858
- G202 # SQL query construction using string concatenation
858859
- G203 # Use of unescaped data in HTML templates
@@ -864,16 +865,21 @@ linters-settings:
864865
- G305 # File traversal when extracting zip/tar archive
865866
- G306 # Poor file permissions used when writing to a new file
866867
- G307 # Poor file permissions used when creating a file with os.Create
867-
- G401 # Detect the usage of DES, RC4, MD5 or SHA1
868+
- G401 # Detect the usage of MD5 or SHA1
868869
- G402 # Look for bad TLS connection settings
869870
- G403 # Ensure minimum RSA key length of 2048 bits
870871
- G404 # Insecure random number source (rand)
872+
- G405 # Detect the usage of DES or RC4
873+
- G406 # Detect the usage of MD4 or RIPEMD160
871874
- G501 # Import blocklist: crypto/md5
872875
- G502 # Import blocklist: crypto/des
873876
- G503 # Import blocklist: crypto/rc4
874877
- G504 # Import blocklist: net/http/cgi
875878
- G505 # Import blocklist: crypto/sha1
879+
- G506 # Import blocklist: golang.org/x/crypto/md4
880+
- G507 #Import blocklist: golang.org/x/crypto/ripemd160
876881
- G601 # Implicit memory aliasing of items from a range statement
882+
- G602 # Slice access out of bounds
877883

878884
# To specify a set of rules to explicitly exclude.
879885
# Available rules: https://github.com/securego/gosec#available-rules
@@ -892,6 +898,7 @@ linters-settings:
892898
- G112 # Potential slowloris attack
893899
- G113 # Usage of Rat.SetString in math/big with an overflow (CVE-2022-23772)
894900
- G114 # Use of net/http serve function that has no support for setting timeouts
901+
- G115 # Potential integer overflow when converting between integer types
895902
- G201 # SQL query construction using format string
896903
- G202 # SQL query construction using string concatenation
897904
- G203 # Use of unescaped data in HTML templates
@@ -903,16 +910,21 @@ linters-settings:
903910
- G305 # File traversal when extracting zip/tar archive
904911
- G306 # Poor file permissions used when writing to a new file
905912
- G307 # Poor file permissions used when creating a file with os.Create
906-
- G401 # Detect the usage of DES, RC4, MD5 or SHA1
913+
- G401 # Detect the usage of MD5 or SHA1
907914
- G402 # Look for bad TLS connection settings
908915
- G403 # Ensure minimum RSA key length of 2048 bits
909916
- G404 # Insecure random number source (rand)
917+
- G405 # Detect the usage of DES or RC4
918+
- G406 # Detect the usage of MD4 or RIPEMD160
910919
- G501 # Import blocklist: crypto/md5
911920
- G502 # Import blocklist: crypto/des
912921
- G503 # Import blocklist: crypto/rc4
913922
- G504 # Import blocklist: net/http/cgi
914923
- G505 # Import blocklist: crypto/sha1
924+
- G506 # Import blocklist: golang.org/x/crypto/md4
925+
- G507 #Import blocklist: golang.org/x/crypto/ripemd160
915926
- G601 # Implicit memory aliasing of items from a range statement
927+
- G602 # Slice access out of bounds
916928

917929
# Exclude generated files
918930
# Default: false

‎.golangci.yml

+15
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,21 @@ issues:
204204
linters: [gocritic]
205205
text: "rangeValCopy: each iteration copies 160 bytes \\(consider pointers or indexing\\)"
206206

207+
# Related to file sizes.
208+
- path: pkg/goanalysis/runner_loadingpackage.go
209+
linters: [gosec]
210+
text: "G115: integer overflow conversion uintptr -> int"
211+
212+
# Related to PID.
213+
- path: test/bench/bench_test.go
214+
linters: [gosec]
215+
text: "G115: integer overflow conversion int -> int32"
216+
217+
# Related to the result of computation but divided multiple times by 1024.
218+
- path: test/bench/bench_test.go
219+
linters: [gosec]
220+
text: "G115: integer overflow conversion uint64 -> int"
221+
207222
exclude-dirs:
208223
- test/testdata_etc # test files
209224
- internal/cache # extracted from Go code

‎go.mod

+4-4
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ require (
9292
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
9393
github.com/sashamelentyev/interfacebloat v1.1.0
9494
github.com/sashamelentyev/usestdlibvars v1.27.0
95-
github.com/securego/gosec/v2 v2.20.1-0.20240525090044-5f0084eb01a9
95+
github.com/securego/gosec/v2 v2.20.1-0.20240820084340-81cda2f91fbe
9696
github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c
9797
github.com/shirou/gopsutil/v3 v3.24.5
9898
github.com/sirupsen/logrus v1.9.3
@@ -125,7 +125,7 @@ require (
125125
go-simpler.org/musttag v0.12.2
126126
go-simpler.org/sloglint v0.7.2
127127
go.uber.org/automaxprocs v1.5.3
128-
golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc
128+
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
129129
golang.org/x/tools v0.24.0
130130
gopkg.in/yaml.v3 v3.0.1
131131
honnef.co/go/tools v0.5.1
@@ -193,8 +193,8 @@ require (
193193
golang.org/x/mod v0.20.0 // indirect
194194
golang.org/x/sync v0.8.0 // indirect
195195
golang.org/x/sys v0.23.0 // indirect
196-
golang.org/x/text v0.15.0 // indirect
197-
google.golang.org/protobuf v1.33.0 // indirect
196+
golang.org/x/text v0.17.0 // indirect
197+
google.golang.org/protobuf v1.34.2 // indirect
198198
gopkg.in/ini.v1 v1.67.0 // indirect
199199
gopkg.in/yaml.v2 v2.4.0 // indirect
200200
)

‎go.sum

+16-16
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎jsonschema/golangci.next.jsonschema.json

+7-1
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@
137137
"G112",
138138
"G113",
139139
"G114",
140+
"G115",
140141
"G201",
141142
"G202",
142143
"G203",
@@ -152,12 +153,17 @@
152153
"G402",
153154
"G403",
154155
"G404",
156+
"G405",
157+
"G406",
155158
"G501",
156159
"G502",
157160
"G503",
158161
"G504",
159162
"G505",
160-
"G601"
163+
"G506",
164+
"G507",
165+
"G601",
166+
"G602"
161167
]
162168
},
163169
"govet-analyzers": {

‎pkg/goanalysis/runners.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ func saveIssuesToCache(allPkgs []*packages.Package, pkgsFromCache map[*packages.
134134
perPkgIssues[i.Pkg] = append(perPkgIssues[i.Pkg], *i)
135135
}
136136

137-
savedIssuesCount := int32(0)
137+
var savedIssuesCount int64 = 0
138138
lintResKey := getIssuesCacheKey(analyzers)
139139

140140
workerCount := runtime.GOMAXPROCS(-1)
@@ -162,7 +162,7 @@ func saveIssuesToCache(allPkgs []*packages.Package, pkgsFromCache map[*packages.
162162
})
163163
}
164164

165-
atomic.AddInt32(&savedIssuesCount, int32(len(encodedIssues)))
165+
atomic.AddInt64(&savedIssuesCount, int64(len(encodedIssues)))
166166
if err := lintCtx.PkgCache.Put(pkg, pkgcache.HashModeNeedAllDeps, lintResKey, encodedIssues); err != nil {
167167
lintCtx.Log.Infof("Failed to save package %s issues (%d) to cache: %s", pkg, len(pkgIssues), err)
168168
} else {

‎pkg/golinters/gosec/gosec.go

+26-4
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"sync"
1111

1212
"github.com/securego/gosec/v2"
13+
"github.com/securego/gosec/v2/analyzers"
1314
"github.com/securego/gosec/v2/issue"
1415
"github.com/securego/gosec/v2/rules"
1516
"golang.org/x/tools/go/analysis"
@@ -27,16 +28,20 @@ func New(settings *config.GoSecSettings) *goanalysis.Linter {
2728
var mu sync.Mutex
2829
var resIssues []goanalysis.Issue
2930

30-
var filters []rules.RuleFilter
3131
conf := gosec.NewConfig()
32+
33+
var ruleFilters []rules.RuleFilter
34+
var analyzerFilters []analyzers.AnalyzerFilter
3235
if settings != nil {
33-
filters = gosecRuleFilters(settings.Includes, settings.Excludes)
36+
ruleFilters = createRuleFilters(settings.Includes, settings.Excludes)
37+
analyzerFilters = createAnalyzerFilters(settings.Includes, settings.Excludes)
3438
conf = toGosecConfig(settings)
3539
}
3640

3741
logger := log.New(io.Discard, "", 0)
3842

39-
ruleDefinitions := rules.Generate(false, filters...)
43+
ruleDefinitions := rules.Generate(false, ruleFilters...)
44+
analyzerDefinitions := analyzers.Generate(false, analyzerFilters...)
4045

4146
analyzer := &analysis.Analyzer{
4247
Name: linterName,
@@ -53,7 +58,9 @@ func New(settings *config.GoSecSettings) *goanalysis.Linter {
5358
analyzer.Run = func(pass *analysis.Pass) (any, error) {
5459
// The `gosecAnalyzer` is here because of concurrency issue.
5560
gosecAnalyzer := gosec.NewAnalyzer(conf, true, settings.ExcludeGenerated, false, settings.Concurrency, logger)
61+
5662
gosecAnalyzer.LoadRules(ruleDefinitions.RulesInfo())
63+
gosecAnalyzer.LoadAnalyzers(analyzerDefinitions.AnalyzersInfo())
5764

5865
issues := runGoSec(lintCtx, pass, settings, gosecAnalyzer)
5966

@@ -176,8 +183,23 @@ func convertGosecGlobals(globalOptionFromConfig any, conf gosec.Config) {
176183
}
177184
}
178185

186+
// based on https://github.com/securego/gosec/blob/81cda2f91fbe1bf4735feb55febcae03e697a92b/cmd/gosec/main.go#L258-L275
187+
func createAnalyzerFilters(includes, excludes []string) []analyzers.AnalyzerFilter {
188+
var filters []analyzers.AnalyzerFilter
189+
190+
if len(includes) > 0 {
191+
filters = append(filters, analyzers.NewAnalyzerFilter(false, includes...))
192+
}
193+
194+
if len(excludes) > 0 {
195+
filters = append(filters, analyzers.NewAnalyzerFilter(true, excludes...))
196+
}
197+
198+
return filters
199+
}
200+
179201
// based on https://github.com/securego/gosec/blob/569328eade2ccbad4ce2d0f21ee158ab5356a5cf/cmd/gosec/main.go#L170-L188
180-
func gosecRuleFilters(includes, excludes []string) []rules.RuleFilter {
202+
func createRuleFilters(includes, excludes []string) []rules.RuleFilter {
181203
var filters []rules.RuleFilter
182204

183205
if len(includes) > 0 {

0 commit comments

Comments
 (0)