|
| 1 | +package rules |
| 2 | + |
| 3 | +import ( |
| 4 | + "go/ast" |
| 5 | + |
| 6 | + "github.com/securego/gosec/v2" |
| 7 | + "github.com/securego/gosec/v2/issue" |
| 8 | +) |
| 9 | + |
| 10 | +type usesHardcodedIV struct { |
| 11 | + issue.MetaData |
| 12 | + trackedFunctions map[string][]int |
| 13 | +} |
| 14 | + |
| 15 | +func (r *usesHardcodedIV) ID() string { |
| 16 | + return r.MetaData.ID |
| 17 | +} |
| 18 | + |
| 19 | +// The code is a little bit spaghetti and there are things that repeat |
| 20 | +// Can be improved |
| 21 | +func (r *usesHardcodedIV) Match(n ast.Node, c *gosec.Context) (*issue.Issue, error) { |
| 22 | + // cast n to a call expression, we can do that safely, because this match method gets only called when CallExpr node is found |
| 23 | + funcCall := n.(*ast.CallExpr) |
| 24 | + |
| 25 | + // cast to a function call from an object and get the function part; example: a.doSomething() |
| 26 | + funcSelector, exists := funcCall.Fun.(*ast.SelectorExpr) |
| 27 | + if exists { |
| 28 | + //Iterate trough the wanted functions |
| 29 | + for functionName, functionNumArgsAndNoncePosArr := range r.trackedFunctions { |
| 30 | + // Check if the call is actually made from an object |
| 31 | + if _, hasX := funcSelector.X.(*ast.Ident); hasX { |
| 32 | + |
| 33 | + // Check if the function name matches with the one we look for, and if the function accepts an exact number of arguments(Function signature) |
| 34 | + if funcSelector.Sel.Name == functionName && len(funcCall.Args) == functionNumArgsAndNoncePosArr[0] { |
| 35 | + |
| 36 | + // Check the type of the passed argument to the function |
| 37 | + switch funcCall.Args[functionNumArgsAndNoncePosArr[1]].(type) { |
| 38 | + |
| 39 | + case *ast.CompositeLit: |
| 40 | + // Check if the argument is static array |
| 41 | + if _, isArray := funcCall.Args[functionNumArgsAndNoncePosArr[1]].(*ast.CompositeLit).Type.(*ast.ArrayType); isArray { |
| 42 | + return c.NewIssue(n, r.ID(), r.What+" by passing hardcoded byte array", r.Severity, r.Confidence), nil |
| 43 | + } |
| 44 | + |
| 45 | + case *ast.CallExpr: |
| 46 | + |
| 47 | + // Check if it's a function call, because []byte() is a function call, and also check if the number of arguments to this call is only 1 |
| 48 | + switch funcCall.Args[functionNumArgsAndNoncePosArr[1]].(*ast.CallExpr).Fun.(type) { |
| 49 | + case *ast.ArrayType: |
| 50 | + return c.NewIssue(n, r.ID(), r.What+" by converting static string to a byte array", r.Severity, r.Confidence), nil |
| 51 | + |
| 52 | + // Check if it's an anonymous function |
| 53 | + case *ast.FuncLit: |
| 54 | + functionCalled, _ := funcCall.Args[functionNumArgsAndNoncePosArr[1]].(*ast.CallExpr).Fun.(*ast.FuncLit) |
| 55 | + |
| 56 | + // Check the type of the last statement in the anonymous function |
| 57 | + switch functionCalled.Body.List[len(functionCalled.Body.List)-1].(type) { |
| 58 | + |
| 59 | + case *ast.IfStmt: |
| 60 | + |
| 61 | + ifStatementContent := functionCalled.Body.List[len(functionCalled.Body.List)-1].(*ast.IfStmt).Body.List |
| 62 | + |
| 63 | + // check if the if statement has return statement |
| 64 | + if retStatement, isReturn := ifStatementContent[len(ifStatementContent)-1].(*ast.ReturnStmt); isReturn { |
| 65 | + argInNestedFunc := retStatement.Results[0] |
| 66 | + |
| 67 | + // check the type of the returned value |
| 68 | + switch argInNestedFunc.(type) { |
| 69 | + case *ast.CompositeLit: |
| 70 | + // Check if the argument is static array |
| 71 | + if _, isArray := argInNestedFunc.(*ast.CompositeLit).Type.(*ast.ArrayType); isArray { |
| 72 | + return c.NewIssue(n, r.ID(), r.What+" by passing hardcoded byte array in a function call", r.Severity, r.Confidence), nil |
| 73 | + } |
| 74 | + |
| 75 | + case *ast.CallExpr: |
| 76 | + if _, ok := argInNestedFunc.(*ast.CallExpr).Fun.(*ast.ArrayType); ok { |
| 77 | + return c.NewIssue(n, r.ID(), r.What+" by converting static string to a byte array in a function call", r.Severity, r.Confidence), nil |
| 78 | + } |
| 79 | + } |
| 80 | + } |
| 81 | + case *ast.ReturnStmt: |
| 82 | + |
| 83 | + argInNestedFunc := functionCalled.Body.List[len(functionCalled.Body.List)-1].(*ast.ReturnStmt).Results[0] |
| 84 | + switch argInNestedFunc.(type) { |
| 85 | + case *ast.CompositeLit: |
| 86 | + // Check if the argument is static array |
| 87 | + if _, isArray := argInNestedFunc.(*ast.CompositeLit).Type.(*ast.ArrayType); isArray { |
| 88 | + return c.NewIssue(n, r.ID(), r.What+" by passing hardcoded byte array in a function call", r.Severity, r.Confidence), nil |
| 89 | + } |
| 90 | + |
| 91 | + case *ast.CallExpr: |
| 92 | + if _, ok := argInNestedFunc.(*ast.CallExpr).Fun.(*ast.ArrayType); ok { |
| 93 | + return c.NewIssue(n, r.ID(), r.What+" by converting static string to a byte array in a function call", r.Severity, r.Confidence), nil |
| 94 | + } |
| 95 | + } |
| 96 | + } |
| 97 | + } |
| 98 | + } |
| 99 | + } |
| 100 | + } |
| 101 | + } |
| 102 | + } |
| 103 | + // loop through the functions we are checking |
| 104 | + |
| 105 | + return nil, nil |
| 106 | +} |
| 107 | + |
| 108 | +func NewUsesHardCodedIV(id string, _ gosec.Config) (gosec.Rule, []ast.Node) { |
| 109 | + calls := make(map[string][]int) |
| 110 | + // Holds the function name as key, the number of arguments that the function accepts, and at which index of those accepted arguments is the nonce/IV |
| 111 | + // Example "Test" 3, 1 -- means the function "Test" which accepts 3 arguments, and has the nonce arg as second argument |
| 112 | + |
| 113 | + calls["Seal"] = []int{4, 1} |
| 114 | + calls["Open"] = []int{4, 1} |
| 115 | + calls["NewCBCDecrypter"] = []int{2, 1} // |
| 116 | + calls["NewCBCEncrypter"] = []int{2, 1} // |
| 117 | + calls["NewCFBDecrypter"] = []int{2, 1} |
| 118 | + calls["NewCFBEncrypter"] = []int{2, 1} |
| 119 | + calls["NewCTR"] = []int{2, 1} // |
| 120 | + calls["NewOFB"] = []int{2, 1} // |
| 121 | + |
| 122 | + rule := &usesHardcodedIV{ |
| 123 | + trackedFunctions: calls, |
| 124 | + MetaData: issue.MetaData{ |
| 125 | + ID: id, |
| 126 | + Severity: issue.High, |
| 127 | + Confidence: issue.Medium, |
| 128 | + What: "Use of hardcoded IV/nonce for encryption", |
| 129 | + }, |
| 130 | + } |
| 131 | + return rule, []ast.Node{(*ast.CallExpr)(nil)} |
| 132 | +} |
0 commit comments