Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

go.mod: ginkgo/v2 v2.3.1, golang.org/x/text v0.3.8, update go versions #880

Merged
merged 3 commits into from
Oct 17, 2022
Merged

go.mod: ginkgo/v2 v2.3.1, golang.org/x/text v0.3.8, update go versions #880

merged 3 commits into from
Oct 17, 2022

Conversation

thaJeztah
Copy link
Contributor

@thaJeztah thaJeztah commented Oct 16, 2022 •
edited
Loading

gha: remove go1.17, temporarily force go1.18.7

The security scanner is flagging the code to have a vulnerability, but it's
detecting that we're running go1.18.6, not "latest" (go1.18.7 at time of writing).

Temporarily pinning to go1.18.7 to force installing the latest version:

Vulnerability #1: GO-2022-1039
  Programs which compile regular expressions from untrusted
  sources may be vulnerable to memory exhaustion or denial of
  service. The parsed regexp representation is linear in the size
  of the input, but in some cases the constant factor can be as
  high as 40,000, making relatively small regexps consume much
  larger amounts of memory. After fix, each regexp being parsed is
  limited to a 256 MB memory footprint. Regular expressions whose
  representation would use more space than that are rejected.
  Normal use of regular expressions is unaffected.

  Call stacks in your code:
  Error:       helpers.go:463:26: github.com/securego/gosec/v2.ExcludedDirsRegExp calls regexp.MustCompile, which eventually calls regexp/syntax.Parse

  Found in: regexp/syntax@go1.18.6
  Fixed in: regexp/syntax@go1.19.2
  More info: https://pkg.go.dev/vuln/GO-2022-1039

go.mod: github.com/onsi/ginkgo/v2 v2.3.1

CI was failing because of a mismatch:

/home/runner/go/bin/ginkgo -v --fail-fast
Ginkgo detected a version mismatch between the Ginkgo CLI and the version of Ginkgo imported by your packages:
  Ginkgo CLI Version:
    2.3.1
  Mismatched package versions found:
   2.2.0 used by gosec

go.mod: golang.org/x/text v0.3.8

to address GO-2022-1059:

The vulnerabilities below are in packages that you import, but your code
doesn't appear to call any vulnerable functions. You may not need to take any
action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
for details.

Vulnerability #1: GO-2022-1059
  An attacker may cause a denial of service by crafting an Accept-Language
  header which ParseAcceptLanguage will take significant time to parse.

  Found in: golang.org/x/text/language@v0.3.7
  Fixed in: golang.org/x/text/language@v0.3.8
  More info: https://pkg.go.dev/vuln/GO-2022-1059

@thaJeztah thaJeztah changed the title go.mod: github.com/onsi/ginkgo/v2 v2.3.1 go.mod: github.com/onsi/ginkgo/v2 v2.3.1, golang.org/x/text v0.3.8 Oct 16, 2022
@thaJeztah thaJeztah changed the title go.mod: github.com/onsi/ginkgo/v2 v2.3.1, golang.org/x/text v0.3.8 go.mod: ginkgo/v2 v2.3.1, golang.org/x/text v0.3.8, update go versions Oct 16, 2022
@codecov-commenter
Copy link

Codecov Report

Base: 73.89% // Head: 73.89% // No change to project coverage 👍

Coverage data is based on head (6f1ec20) compared to base (6cd9e62).
Patch has no changes to coverable lines.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master     #880   +/-   ##
=======================================
  Coverage   73.89%   73.89%           
=======================================
  Files          51       51           
  Lines        3195     3195           
=======================================
  Hits         2361     2361           
  Misses        763      763           
  Partials       71       71

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

thaJeztah
thaJeztah commented Oct 16, 2022
View reviewed changes
.github/workflows/ci.yml
@@ -11,8 +11,7 @@ jobs:
strategy:
matrix:
go_version:
- '1.17'
- '1.18'
- '1.18.7' # TODO: remove this once actions/setup-go@v3 uses latest as latest; see https://github.com/securego/gosec/pull/880
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This shouldn't be needed, but looks like the action installs 1.18.6 otherwise

@thaJeztah
Copy link
Contributor Author

Wow, and now it's installing go1.19.1 ??? Looks like if you don't specify a version, it picks a random 1.19.x version (perhaps caching??)

  Call stacks in your code:
Error:       helpers.go:463:26: github.com/securego/gosec/v2.ExcludedDirsRegExp calls regexp.MustCompile, which eventually calls regexp/syntax.Parse

  Found in: regexp/syntax@go1.19.1
  Fixed in: regexp/syntax@go1.19.2

@thaJeztah
gha: remove go1.17, temporarily force 1.18.7, 1.19.2
2d48d6b 
The  security scanner is flagging the code to have a vulnerability, but it's
detecting that we're running go1.18.6, not "latest" (go1.18.7 at time of writing).

Temporarily pinning to go1.18.7 to force installing the latest version:

    Vulnerability securego#1: GO-2022-1039
      Programs which compile regular expressions from untrusted
      sources may be vulnerable to memory exhaustion or denial of
      service. The parsed regexp representation is linear in the size
      of the input, but in some cases the constant factor can be as
      high as 40,000, making relatively small regexps consume much
      larger amounts of memory. After fix, each regexp being parsed is
      limited to a 256 MB memory footprint. Regular expressions whose
      representation would use more space than that are rejected.
      Normal use of regular expressions is unaffected.

      Call stacks in your code:
      Error:       helpers.go:463:26: github.com/securego/gosec/v2.ExcludedDirsRegExp calls regexp.MustCompile, which eventually calls regexp/syntax.Parse

      Found in: regexp/syntax@go1.18.6
      Fixed in: regexp/syntax@go1.19.2
      More info: https://pkg.go.dev/vuln/GO-2022-1039

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
go.mod: github.com/onsi/ginkgo/v2 v2.3.1
1bcb971 
CI was failing because of a mismatch:

    /home/runner/go/bin/ginkgo -v --fail-fast
    Ginkgo detected a version mismatch between the Ginkgo CLI and the version of Ginkgo imported by your packages:
      Ginkgo CLI Version:
        2.3.1
      Mismatched package versions found:
       2.2.0 used by gosec

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
go.mod: golang.org/x/text v0.3.8
9b4c75d 
to address GO-2022-1059

    The vulnerabilities below are in packages that you import, but your code
    doesn't appear to call any vulnerable functions. You may not need to take any
    action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
    for details.

    Vulnerability securego#1: GO-2022-1059
      An attacker may cause a denial of service by crafting an Accept-Language
      header which ParseAcceptLanguage will take significant time to parse.

      Found in: golang.org/x/text/language@v0.3.7
      Fixed in: golang.org/x/text/language@v0.3.8
      More info: https://pkg.go.dev/vuln/GO-2022-1059

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah thaJeztah mentioned this pull request Oct 16, 2022
Merged
@thaJeztah
Copy link
Contributor Author

@ccojocar ptal 👍

ccojocar
ccojocar approved these changes Oct 17, 2022
View reviewed changes
Copy link
Member

@ccojocar ccojocar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for fixing this! I wanted to do the same until the Go version gets updated into the action.

@ccojocar ccojocar merged commit ed38681 into securego:master Oct 17, 2022
@thaJeztah thaJeztah deleted the bump_ginkgo branch October 17, 2022 09:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ccojocar ccojocar ccojocar approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@thaJeztah @codecov-commenter @ccojocar