Skip to content

Commit f254cec

Browse files
author
Cosmin Cojocar
authored
Merge pull request #216 from ccojocar/rename_gas_with_gosec
Rename gas with gosec
2 parents da26f64 + e6641c6 commit f254cec

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+410
-416
lines changed

‎.github/issue_template.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
### Steps to reproduce the behavior
44

5-
### Gas version
5+
### gosec version
66

77
### Go version (output of 'go version')
88

‎.travis.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ install:
1111
- go get -u github.com/onsi/ginkgo/ginkgo
1212
- go get -u github.com/onsi/gomega
1313
- go get -u golang.org/x/crypto/ssh
14-
- go get -u github.com/securego/gas/cmd/gas/...
14+
- go get -u github.com/securego/gosec/cmd/gosec/...
1515
- go get -v -t ./...
1616
- export PATH=$PATH:$HOME/gopath/bin
1717

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
FROM golang:1.9.4-alpine3.7
22

3-
ENV BIN=gas
3+
ENV BIN=gosec
44

55
COPY build/*-linux-amd64 /go/bin/$BIN
66
COPY docker-entrypoint.sh /usr/local/bin

‎Makefile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
GIT_TAG?= $(shell git describe --always --tags)
22
BUILD_DATE = $(shell date +%Y-%m-%d)
3-
BIN = gas
4-
BUILD_CMD = go build -ldflags "-X main.Version=${VERSION} -X main.GitTag=${GIT_TAG} -X main.BuildDate=${BUILD_DATE}" -o build/$(BIN)-$(VERSION)-$${GOOS}-$${GOARCH} ./cmd/gas/ &
3+
BIN = gosec
4+
BUILD_CMD = go build -ldflags "-X main.Version=${VERSION} -X main.GitTag=${GIT_TAG} -X main.BuildDate=${BUILD_DATE}" -o build/$(BIN)-$(VERSION)-$${GOOS}-$${GOARCH} ./cmd/gosec/ &
55
FMT_CMD = $(gofmt -s -l -w $(find . -type f -name '*.go' -not -path './vendor/*') | tee /dev/stderr)
66
IMAGE_REPO = docker.io
77

@@ -13,12 +13,12 @@ test: bootstrap
1313
test -z '$(FMT_CMD)'
1414
go vet $(go list ./... | grep -v /vendor/)
1515
golint -set_exit_status $(shell go list ./... | grep -v vendor)
16-
gas ./...
16+
gosec ./...
1717
ginkgo -r -v
1818
bootstrap:
1919
dep ensure
2020
build:
21-
go build -o $(BIN) ./cmd/gas/
21+
go build -o $(BIN) ./cmd/gosec/
2222
clean:
2323
rm -rf build vendor
2424
rm -f release image bootstrap $(BIN)

‎README.md‎

Lines changed: 23 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11

22

3-
## GAS - Go Application Security
3+
## gosec -Golang Security Checker
44

55
Inspects source code for security problems by scanning the Go AST.
66

@@ -12,26 +12,23 @@ You may obtain a copy of the License [here](http://www.apache.org/licenses/LICEN
1212

1313
### Project status
1414

15-
[![Build Status](https://travis-ci.org/securego/gas.svg?branch=master)](https://travis-ci.org/securego/gas)
16-
[![GoDoc](https://godoc.org/github.com/securego/gas?status.svg)](https://godoc.org/github.com/securego/gas)
17-
18-
Gas is still in alpha and accepting feedback from early adopters. We do
19-
not consider it production ready at this time.
15+
[![Build Status](https://travis-ci.org/securego/gosec.svg?branch=master)](https://travis-ci.org/securego/gosec)
16+
[![GoDoc](https://godoc.org/github.com/securego/gosec?status.svg)](https://godoc.org/github.com/securego/gosec)
2017

2118
### Install
2219

23-
`$ go get github.com/securego/gas/cmd/gas/...`
20+
`$ go get github.com/securego/gosec/cmd/gosec/...`
2421

2522
### Usage
2623

27-
Gas can be configured to only run a subset of rules, to exclude certain file
24+
Gosec can be configured to only run a subset of rules, to exclude certain file
2825
paths, and produce reports in different formats. By default all rules will be
2926
run against the supplied input files. To recursively scan from the current
3027
directory you can supply './...' as the input argument.
3128

3229
#### Selecting rules
3330

34-
By default Gas will run all rules against the supplied file paths. It is however possible to select a subset of rules to run via the '-include=' flag,
31+
By default gosec will run all rules against the supplied file paths. It is however possible to select a subset of rules to run via the '-include=' flag,
3532
or to specify a set of rules to explicitly exclude using the '-exclude=' flag.
3633

3734
##### Available rules
@@ -63,22 +60,22 @@ or to specify a set of rules to explicitly exclude using the '-exclude=' flag.
6360

6461
```
6562
# Run a specific set of rules
66-
$ gas -include=G101,G203,G401 ./...
63+
$ gosec -include=G101,G203,G401 ./...
6764
6865
# Run everything except for rule G303
69-
$ gas -exclude=G303 ./...
66+
$ gosec -exclude=G303 ./...
7067
```
7168

7269
#### Excluding files:
7370

74-
Gas will ignore dependencies in your vendor directory any files
71+
gosec will ignore dependencies in your vendor directory any files
7572
that are not considered build artifacts by the compiler (so test files).
7673

7774
#### Annotating code
7875

79-
As with all automated detection tools there will be cases of false positives. In cases where Gas reports a failure that has been manually verified as being safe it is possible to annotate the code with a '#nosec' comment.
76+
As with all automated detection tools there will be cases of false positives. In cases where gosec reports a failure that has been manually verified as being safe it is possible to annotate the code with a '#nosec' comment.
8077

81-
The annotation causes Gas to stop processing any further nodes within the
78+
The annotation causes gosec to stop processing any further nodes within the
8279
AST so can apply to a whole block or more granularly to a single expression.
8380

8481
```go
@@ -102,26 +99,26 @@ have been used. To run the scanner and ignore any #nosec annotations you
10299
can do the following:
103100

104101
```
105-
$ gas -nosec=true ./...
102+
$ gosec -nosec=true ./...
106103
```
107104
#### Build tags
108105

109-
Gas is able to pass your [Go build tags](https://golang.org/pkg/go/build/) to the analyzer.
106+
gosec is able to pass your [Go build tags](https://golang.org/pkg/go/build/) to the analyzer.
110107
They can be provided as a comma separated list as follows:
111108

112109
```
113-
$ gas -tag debug,ignore ./...
110+
$ gosec -tag debug,ignore ./...
114111
```
115112

116113
### Output formats
117114

118-
Gas currently supports text, json, yaml, csv and JUnit XML output formats. By default
115+
gosec currently supports text, json, yaml, csv and JUnit XML output formats. By default
119116
results will be reported to stdout, but can also be written to an output
120117
file. The output format is controlled by the '-fmt' flag, and the output file is controlled by the '-out' flag as follows:
121118

122119
```
123120
# Write output in json format to results.json
124-
$ gas -fmt=json -out=results.json *.go
121+
$ gosec -fmt=json -out=results.json *.go
125122
```
126123
### Development
127124

@@ -144,7 +141,7 @@ make test
144141

145142
#### Release Build
146143

147-
Gas can be released as follows:
144+
gosec can be released as follows:
148145

149146
```bash
150147
make release VERSION=2.0.0
@@ -153,11 +150,11 @@ make release VERSION=2.0.0
153150
The released version of the tool is available in the `build` folder. The build information should be displayed in the usage text.
154151

155152
```
156-
./build/gas-2.0.0-linux-amd64 -h
153+
./build/gosec-2.0.0-linux-amd64 -h
157154
158-
GAS - Go AST Scanner
155+
gosec - Golang security checker
159156
160-
Gas analyzes Go source code to look for common programming mistakes that
157+
gosec analyzes Go source code to look for common programming mistakes that
161158
can lead to security problems.
162159
163160
VERSION: 2.0.0
@@ -174,10 +171,10 @@ You can execute a release and build the docker image as follows:
174171
make image VERSION=2.0.0
175172
```
176173

177-
Now you can run the gas tool in a container against your local workspace:
174+
Now you can run the gosec tool in a container against your local workspace:
178175

179176
```
180-
docker run -it -v <YOUR LOCAL WORKSPACE>:/workspace gas /workspace
177+
docker run -it -v <YOUR LOCAL WORKSPACE>:/workspace gosec /workspace
181178
```
182179

183180
#### Generate TLS rule
@@ -188,7 +185,7 @@ The configuration of TLS rule can be generated from [Mozilla's TLS ciphers recom
188185
First you need to install the generator tool:
189186

190187
```
191-
go get github.com/securego/gas/cmd/tlsconfig/...
188+
go get github.com/securego/gosec/cmd/tlsconfig/...
192189
```
193190

194191
You can invoke now the `go generate` in the root of the project:

‎analyzer.go‎

Lines changed: 49 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@
1212
// See the License for the specific language governing permissions and
1313
// limitations under the License.
1414

15-
// Package gas holds the central scanning logic used by GAS
16-
package gas
15+
// Package gosec holds the central scanning logic used by gosec security scanner
16+
package gosec
1717

1818
import (
1919
"go/ast"
@@ -55,7 +55,7 @@ type Metrics struct {
5555
NumFound int `json:"found"`
5656
}
5757

58-
// Analyzer object is the main object of GAS. It has methods traverse an AST
58+
// Analyzer object is the main object of gosec. It has methods traverse an AST
5959
// and invoke the correct checking rules as on each node as required.
6060
type Analyzer struct {
6161
ignoreNosec bool
@@ -74,7 +74,7 @@ func NewAnalyzer(conf Config, logger *log.Logger) *Analyzer {
7474
ignoreNoSec = setting == "true" || setting == "enabled"
7575
}
7676
if logger == nil {
77-
logger = log.New(os.Stderr, "[gas]", log.LstdFlags)
77+
logger = log.New(os.Stderr, "[gosec]", log.LstdFlags)
7878
}
7979
return &Analyzer{
8080
ignoreNosec: ignoreNoSec,
@@ -89,15 +89,15 @@ func NewAnalyzer(conf Config, logger *log.Logger) *Analyzer {
8989

9090
// LoadRules instantiates all the rules to be used when analyzing source
9191
// packages
92-
func (gas *Analyzer) LoadRules(ruleDefinitions map[string]RuleBuilder) {
92+
func (gosec *Analyzer) LoadRules(ruleDefinitions map[string]RuleBuilder) {
9393
for id, def := range ruleDefinitions {
94-
r, nodes := def(id, gas.config)
95-
gas.ruleset.Register(r, nodes...)
94+
r, nodes := def(id, gosec.config)
95+
gosec.ruleset.Register(r, nodes...)
9696
}
9797
}
9898

9999
// Process kicks off the analysis process for a given package
100-
func (gas *Analyzer) Process(buildTags []string, packagePaths ...string) error {
100+
func (gosec *Analyzer) Process(buildTags []string, packagePaths ...string) error {
101101
ctx := build.Default
102102
ctx.BuildTags = append(ctx.BuildTags, buildTags...)
103103
packageConfig := loader.Config{
@@ -111,10 +111,10 @@ func (gas *Analyzer) Process(buildTags []string, packagePaths ...string) error {
111111
return err
112112
}
113113
if _, err := os.Stat(abspath); os.IsNotExist(err) {
114-
gas.logger.Printf("Skipping: %s. Path doesn't exist.", abspath)
114+
gosec.logger.Printf("Skipping: %s. Path doesn't exist.", abspath)
115115
continue
116116
}
117-
gas.logger.Println("Searching directory:", abspath)
117+
gosec.logger.Println("Searching directory:", abspath)
118118

119119
basePackage, err := build.Default.ImportDir(packagePath, build.ImportComment)
120120
if err != nil {
@@ -135,31 +135,31 @@ func (gas *Analyzer) Process(buildTags []string, packagePaths ...string) error {
135135
}
136136

137137
for _, pkg := range builtPackage.Created {
138-
gas.logger.Println("Checking package:", pkg.String())
138+
gosec.logger.Println("Checking package:", pkg.String())
139139
for _, file := range pkg.Files {
140-
gas.logger.Println("Checking file:", builtPackage.Fset.File(file.Pos()).Name())
141-
gas.context.FileSet = builtPackage.Fset
142-
gas.context.Config = gas.config
143-
gas.context.Comments = ast.NewCommentMap(gas.context.FileSet, file, file.Comments)
144-
gas.context.Root = file
145-
gas.context.Info = &pkg.Info
146-
gas.context.Pkg = pkg.Pkg
147-
gas.context.Imports = NewImportTracker()
148-
gas.context.Imports.TrackPackages(gas.context.Pkg.Imports()...)
149-
ast.Walk(gas, file)
150-
gas.stats.NumFiles++
151-
gas.stats.NumLines += builtPackage.Fset.File(file.Pos()).LineCount()
140+
gosec.logger.Println("Checking file:", builtPackage.Fset.File(file.Pos()).Name())
141+
gosec.context.FileSet = builtPackage.Fset
142+
gosec.context.Config = gosec.config
143+
gosec.context.Comments = ast.NewCommentMap(gosec.context.FileSet, file, file.Comments)
144+
gosec.context.Root = file
145+
gosec.context.Info = &pkg.Info
146+
gosec.context.Pkg = pkg.Pkg
147+
gosec.context.Imports = NewImportTracker()
148+
gosec.context.Imports.TrackPackages(gosec.context.Pkg.Imports()...)
149+
ast.Walk(gosec, file)
150+
gosec.stats.NumFiles++
151+
gosec.stats.NumLines += builtPackage.Fset.File(file.Pos()).LineCount()
152152
}
153153
}
154154
return nil
155155
}
156156

157157
// ignore a node (and sub-tree) if it is tagged with a "#nosec" comment
158-
func (gas *Analyzer) ignore(n ast.Node) ([]string, bool) {
159-
if groups, ok := gas.context.Comments[n]; ok && !gas.ignoreNosec {
158+
func (gosec *Analyzer) ignore(n ast.Node) ([]string, bool) {
159+
if groups, ok := gosec.context.Comments[n]; ok && !gosec.ignoreNosec {
160160
for _, group := range groups {
161161
if strings.Contains(group.Text(), "#nosec") {
162-
gas.stats.NumNosec++
162+
gosec.stats.NumNosec++
163163

164164
// Pull out the specific rules that are listed to be ignored.
165165
re := regexp.MustCompile("(G\\d{3})")
@@ -182,27 +182,27 @@ func (gas *Analyzer) ignore(n ast.Node) ([]string, bool) {
182182
return nil, false
183183
}
184184

185-
// Visit runs the GAS visitor logic over an AST created by parsing go code.
185+
// Visit runs the gosec visitor logic over an AST created by parsing go code.
186186
// Rule methods added with AddRule will be invoked as necessary.
187-
func (gas *Analyzer) Visit(n ast.Node) ast.Visitor {
187+
func (gosec *Analyzer) Visit(n ast.Node) ast.Visitor {
188188
// If we've reached the end of this branch, pop off the ignores stack.
189189
if n == nil {
190-
if len(gas.context.Ignores) > 0 {
191-
gas.context.Ignores = gas.context.Ignores[1:]
190+
if len(gosec.context.Ignores) > 0 {
191+
gosec.context.Ignores = gosec.context.Ignores[1:]
192192
}
193-
return gas
193+
return gosec
194194
}
195195

196196
// Get any new rule exclusions.
197-
ignoredRules, ignoreAll := gas.ignore(n)
197+
ignoredRules, ignoreAll := gosec.ignore(n)
198198
if ignoreAll {
199199
return nil
200200
}
201201

202202
// Now create the union of exclusions.
203203
ignores := make(map[string]bool, 0)
204-
if len(gas.context.Ignores) > 0 {
205-
for k, v := range gas.context.Ignores[0] {
204+
if len(gosec.context.Ignores) > 0 {
205+
for k, v := range gosec.context.Ignores[0] {
206206
ignores[k] = v
207207
}
208208
}
@@ -212,37 +212,37 @@ func (gas *Analyzer) Visit(n ast.Node) ast.Visitor {
212212
}
213213

214214
// Push the new set onto the stack.
215-
gas.context.Ignores = append([]map[string]bool{ignores}, gas.context.Ignores...)
215+
gosec.context.Ignores = append([]map[string]bool{ignores}, gosec.context.Ignores...)
216216

217217
// Track aliased and initialization imports
218-
gas.context.Imports.TrackImport(n)
218+
gosec.context.Imports.TrackImport(n)
219219

220-
for _, rule := range gas.ruleset.RegisteredFor(n) {
220+
for _, rule := range gosec.ruleset.RegisteredFor(n) {
221221
if _, ok := ignores[rule.ID()]; ok {
222222
continue
223223
}
224-
issue, err := rule.Match(n, gas.context)
224+
issue, err := rule.Match(n, gosec.context)
225225
if err != nil {
226-
file, line := GetLocation(n, gas.context)
226+
file, line := GetLocation(n, gosec.context)
227227
file = path.Base(file)
228-
gas.logger.Printf("Rule error: %v => %s (%s:%d)\n", reflect.TypeOf(rule), err, file, line)
228+
gosec.logger.Printf("Rule error: %v => %s (%s:%d)\n", reflect.TypeOf(rule), err, file, line)
229229
}
230230
if issue != nil {
231-
gas.issues = append(gas.issues, issue)
232-
gas.stats.NumFound++
231+
gosec.issues = append(gosec.issues, issue)
232+
gosec.stats.NumFound++
233233
}
234234
}
235-
return gas
235+
return gosec
236236
}
237237

238238
// Report returns the current issues discovered and the metrics about the scan
239-
func (gas *Analyzer) Report() ([]*Issue, *Metrics) {
240-
return gas.issues, gas.stats
239+
func (gosec *Analyzer) Report() ([]*Issue, *Metrics) {
240+
return gosec.issues, gosec.stats
241241
}
242242

243243
// Reset clears state such as context, issues and metrics from the configured analyzer
244-
func (gas *Analyzer) Reset() {
245-
gas.context = &Context{}
246-
gas.issues = make([]*Issue, 0, 16)
247-
gas.stats = &Metrics{}
244+
func (gosec *Analyzer) Reset() {
245+
gosec.context = &Context{}
246+
gosec.issues = make([]*Issue, 0, 16)
247+
gosec.stats = &Metrics{}
248248
}

0 commit comments

Comments
 (0)