gopkg.in/alecthomas/gometalinter.v3@v3.0.0/_linters/src/github.com/securego/gosec/rules/blacklist.go (about) 1 // (c) Copyright 2016 Hewlett Packard Enterprise Development LP 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 package rules 16 17 import ( 18 "go/ast" 19 "strings" 20 21 "github.com/securego/gosec" 22 ) 23 24 type blacklistedImport struct { 25 gosec.MetaData 26 Blacklisted map[string]string 27 } 28 29 func unquote(original string) string { 30 copy := strings.TrimSpace(original) 31 copy = strings.TrimLeft(copy, `"`) 32 return strings.TrimRight(copy, `"`) 33 } 34 35 func (r *blacklistedImport) ID() string { 36 return r.MetaData.ID 37 } 38 39 func (r *blacklistedImport) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) { 40 if node, ok := n.(*ast.ImportSpec); ok { 41 if description, ok := r.Blacklisted[unquote(node.Path.Value)]; ok { 42 return gosec.NewIssue(c, node, r.ID(), description, r.Severity, r.Confidence), nil 43 } 44 } 45 return nil, nil 46 } 47 48 // NewBlacklistedImports reports when a blacklisted import is being used. 49 // Typically when a deprecated technology is being used. 50 func NewBlacklistedImports(id string, conf gosec.Config, blacklist map[string]string) (gosec.Rule, []ast.Node) { 51 return &blacklistedImport{ 52 MetaData: gosec.MetaData{ 53 ID: id, 54 Severity: gosec.Medium, 55 Confidence: gosec.High, 56 }, 57 Blacklisted: blacklist, 58 }, []ast.Node{(*ast.ImportSpec)(nil)} 59 } 60 61 // NewBlacklistedImportMD5 fails if MD5 is imported 62 func NewBlacklistedImportMD5(id string, conf gosec.Config) (gosec.Rule, []ast.Node) { 63 return NewBlacklistedImports(id, conf, map[string]string{ 64 "crypto/md5": "Blacklisted import crypto/md5: weak cryptographic primitive", 65 }) 66 } 67 68 // NewBlacklistedImportDES fails if DES is imported 69 func NewBlacklistedImportDES(id string, conf gosec.Config) (gosec.Rule, []ast.Node) { 70 return NewBlacklistedImports(id, conf, map[string]string{ 71 "crypto/des": "Blacklisted import crypto/des: weak cryptographic primitive", 72 }) 73 } 74 75 // NewBlacklistedImportRC4 fails if DES is imported 76 func NewBlacklistedImportRC4(id string, conf gosec.Config) (gosec.Rule, []ast.Node) { 77 return NewBlacklistedImports(id, conf, map[string]string{ 78 "crypto/rc4": "Blacklisted import crypto/rc4: weak cryptographic primitive", 79 }) 80 } 81 82 // NewBlacklistedImportCGI fails if CGI is imported 83 func NewBlacklistedImportCGI(id string, conf gosec.Config) (gosec.Rule, []ast.Node) { 84 return NewBlacklistedImports(id, conf, map[string]string{ 85 "net/http/cgi": "Blacklisted import net/http/cgi: Go versions < 1.6.3 are vulnerable to Httpoxy attack: (CVE-2016-5386)", 86 }) 87 } 88 89 // NewBlacklistedImportSHA1 fails if SHA1 is imported 90 func NewBlacklistedImportSHA1(id string, conf gosec.Config) (gosec.Rule, []ast.Node) { 91 return NewBlacklistedImports(id, conf, map[string]string{ 92 "crypto/sha1": "Blacklisted import crypto/sha1: weak cryptographic primitive", 93 }) 94 }