Port readfile rule to include ID and metadata

holyspectral · Mar 9, 2018 · 90fe5cb · 90fe5cb
1 parent 58a48c4
commit 90fe5cb
Showing 1 changed file with 18 additions and 3 deletions.
diff --git a/rules/readfile.go b/rules/readfile.go
@@ -22,17 +22,24 @@ import (
 )
 
 type readfile struct {
+	gas.MetaData
 	gas.CallList
 }
 
+// ID returns the identifier for this rule
+func (r *readfile) ID() string {
+	return r.MetaData.ID
+}
+
+
 // Match inspects AST nodes to determine if the match the methods `os.Open` or `ioutil.ReadFile`
 func (r *readfile) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
 	if node := r.ContainsCallExpr(n, c); node != nil {
 		for _, arg := range node.Args {
 			if ident, ok := arg.(*ast.Ident); ok {
 				obj := c.Info.ObjectOf(ident)
 				if _, ok := obj.(*types.Var); ok && !gas.TryResolve(ident, c) {
-					return gas.NewIssue(c, n, "File inclusion launched with variable", gas.Medium, gas.High), nil
+					return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
 				}
 			}
 		}
@@ -41,8 +48,16 @@ func (r *readfile) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
 }
 
 // NewReadFile detects cases where we read files
-func NewReadFile(conf gas.Config) (gas.Rule, []ast.Node) {
-	rule := &readfile{gas.NewCallList()}
+func NewReadFile(id string, conf gas.Config) (gas.Rule, []ast.Node) {
+	rule := &readfile{
+        CallList: gas.NewCallList(),
+		MetaData: gas.MetaData{
+			ID:         id,
+			What:       "Potential file inclusion via variable",
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+        },
+    }
 	rule.Add("io/ioutil", "ReadFile")
 	rule.Add("os", "Open")
 	return rule, []ast.Node{(*ast.CallExpr)(nil)}