Skip to content

Commit e925d3c

Browse files
gcmurphygcmurphy
committed
Migrated old test cases.
1 parent 25d74c6 commit e925d3c

File tree

6 files changed

+562
-40
lines changed

6 files changed

+562
-40
lines changed

‎call_list.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ func (c CallList) ContainsCallExpr(n ast.Node, ctx *Context) *ast.CallExpr {
6060
if err != nil {
6161
return nil
6262
}
63+
6364
// Try direct resolution
6465
if c.Contains(selector, ident) {
6566
return n.(*ast.CallExpr)

‎rules/blacklist.go‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ package rules
1616

1717
import (
1818
"go/ast"
19+
"strings"
1920

2021
"github.com/GoASTScanner/gas"
2122
)
@@ -25,11 +26,16 @@ type blacklistedImport struct {
2526
Blacklisted map[string]string
2627
}
2728

28-
func (r *blacklistedImport) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
29+
func unquote(original string) string {
30+
copy := strings.TrimSpace(original)
31+
copy = strings.TrimLeft(copy, `"`)
32+
return strings.TrimRight(copy, `"`)
33+
}
34+
35+
func (r *blacklistedImport) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
2936
if node, ok := n.(*ast.ImportSpec); ok {
30-
description, ok := r.Blacklisted[node.Path.Value]
31-
if ok && node.Name.String() != "_" {
32-
return gas.NewIssue(c, n, description, r.Severity, r.Confidence), nil
37+
if description, ok := r.Blacklisted[unquote(node.Path.Value)]; ok {
38+
return gas.NewIssue(c, node, description, r.Severity, r.Confidence), nil
3339
}
3440
}
3541
return nil, nil
@@ -50,27 +56,27 @@ func NewBlacklistedImports(conf gas.Config, blacklist map[string]string) (gas.Ru
5056
// NewBlacklistedImportMD5 fails if MD5 is imported
5157
func NewBlacklistedImportMD5(conf gas.Config) (gas.Rule, []ast.Node) {
5258
return NewBlacklistedImports(conf, map[string]string{
53-
"crypto/md5": "Use of weak cryptographic primitive",
59+
"crypto/md5": "Blacklisted import crypto/md5: weak cryptographic primitive",
5460
})
5561
}
5662

5763
// NewBlacklistedImportDES fails if DES is imported
5864
func NewBlacklistedImportDES(conf gas.Config) (gas.Rule, []ast.Node) {
5965
return NewBlacklistedImports(conf, map[string]string{
60-
"crypto/des": "Use of weak cryptographic primitive",
66+
"crypto/des": "Blacklisted import crypto/des: weak cryptographic primitive",
6167
})
6268
}
6369

6470
// NewBlacklistedImportRC4 fails if DES is imported
6571
func NewBlacklistedImportRC4(conf gas.Config) (gas.Rule, []ast.Node) {
6672
return NewBlacklistedImports(conf, map[string]string{
67-
"crypto/rc4": "Use of weak cryptographic primitive",
73+
"crypto/rc4": "Blacklisted import crypto/rc4: weak cryptographic primitive",
6874
})
6975
}
7076

7177
// NewBlacklistedImportCGI fails if CGI is imported
7278
func NewBlacklistedImportCGI(conf gas.Config) (gas.Rule, []ast.Node) {
7379
return NewBlacklistedImports(conf, map[string]string{
74-
"net/http/cgi": "Go versions < 1.6.3 are vulnerable to Httpoxy attack: (CVE-2016-5386)",
80+
"net/http/cgi": "Blacklisted import net/http/cgi: Go versions < 1.6.3 are vulnerable to Httpoxy attack: (CVE-2016-5386)",
7581
})
7682
}

‎rules/rules_test.go‎

Lines changed: 68 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,22 +47,86 @@ var _ = Describe("gas rules", func() {
4747
})
4848

4949
Context("report correct errors for all samples", func() {
50-
It("should work for G101 samples", func() {
50+
It("should detect hardcoded credentials", func() {
5151
runner("G101", testutils.SampleCodeG101)
5252
})
5353

54-
It("should work for G102 samples", func() {
54+
It("should detect binding to all network interfaces", func() {
5555
runner("G102", testutils.SampleCodeG102)
5656
})
5757

58-
It("should work for G103 samples", func() {
58+
It("should use of unsafe block", func() {
5959
runner("G103", testutils.SampleCodeG103)
6060
})
6161

62-
It("should work for G104 samples", func() {
62+
It("should errors not being checked", func() {
6363
runner("G104", testutils.SampleCodeG104)
6464
})
6565

66+
It("should detect of big.Exp function", func() {
67+
runner("G105", testutils.SampleCodeG105)
68+
})
69+
70+
It("should detect sql injection via format strings", func() {
71+
runner("G201", testutils.SampleCodeG201)
72+
})
73+
74+
It("should detect sql injection via string concatenation", func() {
75+
runner("G202", testutils.SampleCodeG202)
76+
})
77+
78+
It("should detect unescaped html in templates", func() {
79+
runner("G203", testutils.SampleCodeG203)
80+
})
81+
82+
It("should detect command execution", func() {
83+
runner("G204", testutils.SampleCodeG204)
84+
})
85+
86+
It("should detect poor file permissions on mkdir", func() {
87+
runner("G301", testutils.SampleCodeG301)
88+
})
89+
90+
It("should detect poor permissions when creating or chmod a file", func() {
91+
runner("G302", testutils.SampleCodeG302)
92+
})
93+
94+
It("should detect insecure temp file creation", func() {
95+
runner("G303", testutils.SampleCodeG303)
96+
})
97+
98+
It("should detect weak crypto algorithms", func() {
99+
runner("G401", testutils.SampleCodeG401)
100+
})
101+
102+
It("should find insecure tls settings", func() {
103+
runner("G402", testutils.SampleCodeG402)
104+
})
105+
106+
It("should detect weak creation of weak rsa keys", func() {
107+
runner("G403", testutils.SampleCodeG403)
108+
})
109+
110+
It("should find non cryptographically secure random number sources", func() {
111+
runner("G404", testutils.SampleCodeG404)
112+
})
113+
114+
It("should detect blacklisted imports - MD5", func() {
115+
runner("G501", testutils.SampleCodeG501)
116+
})
117+
118+
It("should detect blacklisted imports - DES", func() {
119+
runner("G502", testutils.SampleCodeG502)
120+
})
121+
122+
It("should detect blacklisted imports - RC4", func() {
123+
runner("G503", testutils.SampleCodeG503)
124+
})
125+
126+
It("should detect blacklisted imports - CGI (httpoxy)", func() {
127+
runner("G504", testutils.SampleCodeG504)
128+
})
129+
66130
})
67131

68132
})

‎rules/templates.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,9 @@ func NewTemplateCheck(conf gas.Config) (gas.Rule, []ast.Node) {
4444
calls.Add("template", "HTML")
4545
calls.Add("template", "HTMLAttr")
4646
calls.Add("template", "JS")
47+
calls.Add("template", "URL")
4748
return &templateCheck{
48-
calls: gas.NewCallList(),
49+
calls: calls,
4950
MetaData: gas.MetaData{
5051
Severity: gas.Medium,
5152
Confidence: gas.Low,

‎rules/tls.go‎

Lines changed: 18 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -38,23 +38,13 @@ func stringInSlice(a string, list []string) bool {
3838
}
3939

4040
func (t *insecureConfigTLS) processTLSCipherSuites(n ast.Node, c *gas.Context) *gas.Issue {
41-
tlsConfig := gas.MatchCompLit(n, c, t.requiredType)
42-
if tlsConfig == nil {
43-
return nil
44-
}
4541

46-
for _, expr := range tlsConfig.Elts {
47-
if keyvalExpr, ok := expr.(*ast.KeyValueExpr); ok {
48-
if keyname, ok := keyvalExpr.Key.(*ast.Ident); ok && keyname.Name == "CipherSuites" {
49-
if ciphers, ok := keyvalExpr.Value.(*ast.CompositeLit); ok {
50-
for _, cipher := range ciphers.Elts {
51-
if ident, ok := cipher.(*ast.SelectorExpr); ok {
52-
if !stringInSlice(ident.Sel.Name, t.goodCiphers) {
53-
str := fmt.Sprintf("TLS Bad Cipher Suite: %s", ident.Sel.Name)
54-
return gas.NewIssue(c, n, str, gas.High, gas.High)
55-
}
56-
}
57-
}
42+
if ciphers, ok := n.(*ast.CompositeLit); ok {
43+
for _, cipher := range ciphers.Elts {
44+
if ident, ok := cipher.(*ast.SelectorExpr); ok {
45+
if !stringInSlice(ident.Sel.Name, t.goodCiphers) {
46+
err := fmt.Sprintf("TLS Bad Cipher Suite: %s", ident.Sel.Name)
47+
return gas.NewIssue(c, ident, err, gas.High, gas.High)
5848
}
5949
}
6050
}
@@ -65,6 +55,7 @@ func (t *insecureConfigTLS) processTLSCipherSuites(n ast.Node, c *gas.Context) *
6555
func (t *insecureConfigTLS) processTLSConfVal(n *ast.KeyValueExpr, c *gas.Context) *gas.Issue {
6656
if ident, ok := n.Key.(*ast.Ident); ok {
6757
switch ident.Name {
58+
6859
case "InsecureSkipVerify":
6960
if node, ok := n.Value.(*ast.Ident); ok {
7061
if node.Name != "false" {
@@ -104,7 +95,7 @@ func (t *insecureConfigTLS) processTLSConfVal(n *ast.KeyValueExpr, c *gas.Contex
10495
}
10596

10697
case "CipherSuites":
107-
if ret := t.processTLSCipherSuites(n, c); ret != nil {
98+
if ret := t.processTLSCipherSuites(n.Value, c); ret != nil {
10899
return ret
109100
}
110101

@@ -114,24 +105,24 @@ func (t *insecureConfigTLS) processTLSConfVal(n *ast.KeyValueExpr, c *gas.Contex
114105
return nil
115106
}
116107

117-
func (t *insecureConfigTLS) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
118-
if node := gas.MatchCompLit(n, c, t.requiredType); node != nil {
119-
for _, elt := range node.Elts {
108+
func (t *insecureConfigTLS) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
109+
if complit, ok := n.(*ast.CompositeLit); ok && c.Info.TypeOf(complit.Type).String() == t.requiredType {
110+
for _, elt := range complit.Elts {
120111
if kve, ok := elt.(*ast.KeyValueExpr); ok {
121-
gi = t.processTLSConfVal(kve, c)
122-
if gi != nil {
123-
break
112+
issue := t.processTLSConfVal(kve, c)
113+
if issue != nil {
114+
return issue, nil
124115
}
125116
}
126117
}
127118
}
128-
return
119+
return nil, nil
129120
}
130121

131122
// NewModernTLSCheck see: https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
132123
func NewModernTLSCheck(conf gas.Config) (gas.Rule, []ast.Node) {
133124
return &insecureConfigTLS{
134-
requiredType: "tls.Config",
125+
requiredType: "crypto/tls.Config",
135126
MinVersion: 0x0303, // TLS 1.2 only
136127
MaxVersion: 0x0303,
137128
goodCiphers: []string{
@@ -146,7 +137,7 @@ func NewModernTLSCheck(conf gas.Config) (gas.Rule, []ast.Node) {
146137
// NewIntermediateTLSCheck see: https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29
147138
func NewIntermediateTLSCheck(conf gas.Config) (gas.Rule, []ast.Node) {
148139
return &insecureConfigTLS{
149-
requiredType: "tls.Config",
140+
requiredType: "crypto/tls.Config",
150141
MinVersion: 0x0301, // TLS 1.2, 1.1, 1.0
151142
MaxVersion: 0x0303,
152143
goodCiphers: []string{
@@ -172,7 +163,7 @@ func NewIntermediateTLSCheck(conf gas.Config) (gas.Rule, []ast.Node) {
172163
// NewCompatTLSCheck see: https://wiki.mozilla.org/Security/Server_Side_TLS#Old_compatibility_.28default.29
173164
func NewCompatTLSCheck(conf gas.Config) (gas.Rule, []ast.Node) {
174165
return &insecureConfigTLS{
175-
requiredType: "tls.Config",
166+
requiredType: "crypto/tls.Config",
176167
MinVersion: 0x0301, // TLS 1.2, 1.1, 1.0
177168
MaxVersion: 0x0303,
178169
goodCiphers: []string{

0 commit comments

Comments
 (0)