Extend the rule G304 with os.OpenFile and add a test to cover it

Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
knightyzl · Jun 17, 2020 · 1d2c951 · 1d2c951
1 parent 0c1a71b
commit 1d2c951
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/rules/readfile.go b/rules/readfile.go
@@ -102,5 +102,6 @@ func NewReadFile(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
 	rule.pathJoin.Add("path", "Join")
 	rule.Add("io/ioutil", "ReadFile")
 	rule.Add("os", "Open")
+	rule.Add("os", "OpenFile")
 	return rule, []ast.Node{(*ast.CallExpr)(nil)}
 }
diff --git a/testutils/source.go b/testutils/source.go
@@ -1478,6 +1478,30 @@ func main() {
 }`}, 1, gosec.NewConfig()}, {[]string{`
 package main
 
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+)
+
+func main() {
+	http.HandleFunc("/bar", func(w http.ResponseWriter, r *http.Request) {
+  		title := r.URL.Query().Get("title")
+		f, err := os.OpenFile(title, os.O_RDWR|os.O_CREATE, 0755)
+		if err != nil {
+			fmt.Printf("Error: %v\n", err)
+		}
+		body := make([]byte, 5)
+		if _, err = f.Read(body); err != nil {
+			fmt.Printf("Error: %v\n", err)
+		}
+		fmt.Fprintf(w, "%s", body)
+	})
+	log.Fatal(http.ListenAndServe(":3000", nil))
+}`}, 1, gosec.NewConfig()}, {[]string{`
+package main
+
 import (
 	"log"
 	"os"