From 10f761dbcb2d01e84fde047877fee9a30be7cc35 Mon Sep 17 00:00:00 2001 From: Chris Cummer Date: Tue, 17 Dec 2019 14:59:16 -0800 Subject: [PATCH] 20191217 gosec (#796) * Add gosec to the Makefile Signed-off-by: Chris Cummer * Fix some issues found by gosec Signed-off-by: Chris Cummer --- Makefile | 12 ++++++++---- cfg/copy.go | 2 +- go.mod | 7 ++++++- go.sum | 14 ++++++++++++-- modules/cmdrunner/widget.go | 5 ++++- modules/gcal/client.go | 9 +++++---- modules/googleanalytics/client.go | 3 ++- modules/gspreadsheets/client.go | 4 ++-- modules/textfile/widget.go | 7 ++++--- utils/utils.go | 3 ++- view/bargraph.go | 5 ++++- 11 files changed, 50 insertions(+), 21 deletions(-) diff --git a/Makefile b/Makefile index 92c1b28c..8d5a0bc7 100644 --- a/Makefile +++ b/Makefile @@ -48,6 +48,10 @@ coverage: go test -coverprofile=coverage.out ./... go tool cover -html=coverage.out +## gosec: runs the gosec static security scanner against the source code +gosec: + gosec -tests ./... + ## help: prints this help message help: @echo "Usage: \n" @@ -104,14 +108,14 @@ lint: staticcheck ./wtf staticcheck ./main.go +## loc: displays the lines of code (LoC) count +loc: + @loc --exclude _sample_configs/ _site/ docs/ Makefile *.md + ## run: executes the locally-installed version run: build bin/${APP} -## size: displays the lines of code (LoC) count -size: - @loc --exclude _sample_configs/ _site/ docs/ Makefile *.md - ## test: runs the test suite test: build go test ./... diff --git a/cfg/copy.go b/cfg/copy.go index b45ac48b..b84b329c 100644 --- a/cfg/copy.go +++ b/cfg/copy.go @@ -40,7 +40,7 @@ func fcopy(src, dest string, info os.FileInfo) error { return err } - s, err := os.Open(src) + s, err := os.Open(filepath.Clean(src)) if err != nil { return err } diff --git a/go.mod b/go.mod index 65051a89..ff58edce 100644 --- a/go.mod +++ b/go.mod @@ -24,6 +24,7 @@ require ( github.com/gdamore/tcell v1.3.0 github.com/go-ole/go-ole v1.2.4 // indirect github.com/godbus/dbus v4.1.0+incompatible // indirect + github.com/golang/protobuf v1.3.2 // indirect github.com/google/go-github/v26 v26.1.3 github.com/gophercloud/gophercloud v0.5.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.1 // indirect @@ -37,7 +38,8 @@ require ( github.com/mmcdole/goxpp v0.0.0-20181012175147-0068e33feabf // indirect github.com/olebedev/config v0.0.0-20190528211619-364964f3a8e4 github.com/olekukonko/tablewriter v0.0.4 - github.com/onsi/ginkgo v1.10.2 // indirect + github.com/onsi/ginkgo v1.10.3 // indirect + github.com/onsi/gomega v1.7.1 // indirect github.com/opencontainers/go-digest v1.0.0-rc1 // indirect github.com/pkg/errors v0.8.1 github.com/pkg/profile v1.4.0 @@ -51,8 +53,11 @@ require ( github.com/zmb3/spotify v0.0.0-20191010212056-e12fb981aacb github.com/zorkian/go-datadog-api v2.25.0+incompatible golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 // indirect + golang.org/x/net v0.0.0-20190923162816-aa69164e4478 // indirect golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 + golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 // indirect google.golang.org/api v0.14.0 + gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect gopkg.in/jarcoal/httpmock.v1 v1.0.0-20181110093347-3be5f16b70eb // indirect gopkg.in/yaml.v2 v2.2.7 k8s.io/api v0.0.0-20191010143144-fbf594f18f80 // indirect diff --git a/go.sum b/go.sum index 6d8179f0..ac9b0c39 100644 --- a/go.sum +++ b/go.sum @@ -107,6 +107,8 @@ github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+ github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.1 h1:YF8+flBXS5eO826T4nzqPrxfhQThhXl0YzfuUPu4SBg= github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs= +github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/google/btree v0.0.0-20160524151835-7d79101e329e/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= @@ -207,12 +209,14 @@ github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.10.1 h1:q/mM8GF/n0shIN8SaAZ0V+jnLPzen6WIVZdiwrRlMlo= github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= -github.com/onsi/ginkgo v1.10.2 h1:uqH7bpe+ERSiDa34FDOF7RikN6RzXgduUF8yarlZp94= -github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= +github.com/onsi/ginkgo v1.10.3 h1:OoxbjfXVZyod1fmWYhI7SEyaD8B00ynP3T+D5GiyHOY= +github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA= github.com/onsi/gomega v0.0.0-20190113212917-5533ce8a0da3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME= github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= +github.com/onsi/gomega v1.7.1 h1:K0jcRCwNQM3vFGh1ppMtDh/+7ApJrjldlX8fA0jDTLQ= +github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/opencontainers/go-digest v1.0.0-rc1 h1:WzifXhOVOEOuFYOJAW6aQqW0TooG2iki3E3Ii+WN7gQ= github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s= github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU= @@ -289,6 +293,8 @@ golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc h1:gkKoSkUmnU6bpS/VhkuO27bzQeSA51uaEfbOW5dNb68= golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190923162816-aa69164e4478 h1:l5EDrHhldLYb3ZRHDUhXF7Om7MvYXnkV9/iQNo1lX6g= +golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -312,6 +318,8 @@ golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190626150813-e07cf5db2756 h1:9nuHUbU8dRnRRfj9KjWUVrJeoexdbeMjttk6Oh1rD10= golang.org/x/sys v0.0.0-20190626150813-e07cf5db2756/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 h1:rOhMmluY6kLMhdnrivzec6lLgaVbMHMn2ISQXJeJ5EM= +golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -351,6 +359,8 @@ google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiq gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/inf.v0 v0.9.0 h1:3zYtXIO92bvsdS3ggAdA8Gb4Azj0YU+TVY1uGYNFA8o= diff --git a/modules/cmdrunner/widget.go b/modules/cmdrunner/widget.go index 6e2f2eff..d0b900af 100644 --- a/modules/cmdrunner/widget.go +++ b/modules/cmdrunner/widget.go @@ -128,7 +128,10 @@ func runCommandLoop(widget *Widget) { // The command has exited, print any error messages if err != nil { widget.m.Lock() - widget.buffer.WriteString(err.Error()) + _, err := widget.buffer.WriteString(err.Error()) + if err != nil { + return + } widget.m.Unlock() } widget.redrawChan <- true diff --git a/modules/gcal/client.go b/modules/gcal/client.go index 84bc60f8..7fe08d90 100644 --- a/modules/gcal/client.go +++ b/modules/gcal/client.go @@ -15,6 +15,7 @@ import ( "log" "net/http" "os" + "path/filepath" "sort" "time" @@ -33,7 +34,7 @@ func (widget *Widget) Fetch() ([]*CalEvent, error) { secretPath, _ := utils.ExpandHomeDir(widget.settings.secretFile) - b, err := ioutil.ReadFile(secretPath) + b, err := ioutil.ReadFile(filepath.Clean(secretPath)) if err != nil { return nil, err } @@ -125,9 +126,9 @@ func isAuthenticated() bool { } func (widget *Widget) authenticate() { - secretPath, _ := utils.ExpandHomeDir(widget.settings.secretFile) + secretPath, _ := utils.ExpandHomeDir(filepath.Clean(widget.settings.secretFile)) - b, err := ioutil.ReadFile(secretPath) + b, err := ioutil.ReadFile(filepath.Clean(secretPath)) if err != nil { log.Fatalf("Unable to read secret file. %v", widget.settings.secretFile) } @@ -166,7 +167,7 @@ func tokenCacheFile() (string, error) { // tokenFromFile retrieves a Token from a given file path. // It returns the retrieved Token and any read error encountered. func tokenFromFile(file string) (*oauth2.Token, error) { - f, err := os.Open(file) + f, err := os.Open(filepath.Clean(file)) if err != nil { return nil, err } diff --git a/modules/googleanalytics/client.go b/modules/googleanalytics/client.go index 1e2110bf..f534b2a9 100644 --- a/modules/googleanalytics/client.go +++ b/modules/googleanalytics/client.go @@ -6,6 +6,7 @@ import ( "io/ioutil" "log" "net/http" + "path/filepath" "time" "github.com/wtfutil/wtf/utils" @@ -47,7 +48,7 @@ func (widget *Widget) Fetch() []websiteReport { } func buildNetClient(secretPath string) *http.Client { - clientSecret, err := ioutil.ReadFile(secretPath) + clientSecret, err := ioutil.ReadFile(filepath.Clean(secretPath)) if err != nil { log.Fatalf("Unable to read secretPath. %v", err) } diff --git a/modules/gspreadsheets/client.go b/modules/gspreadsheets/client.go index 22cc4713..8ce4cf99 100644 --- a/modules/gspreadsheets/client.go +++ b/modules/gspreadsheets/client.go @@ -32,7 +32,7 @@ func (widget *Widget) Fetch() ([]*sheets.ValueRange, error) { secretPath, _ := utils.ExpandHomeDir(widget.settings.secretFile) - b, err := ioutil.ReadFile(secretPath) + b, err := ioutil.ReadFile(filepath.Clean(secretPath)) if err != nil { log.Fatalf("Unable to read secretPath. %v", err) return nil, err @@ -125,7 +125,7 @@ func tokenCacheFile() (string, error) { // tokenFromFile retrieves a Token from a given file path. // It returns the retrieved Token and any read error encountered. func tokenFromFile(file string) (*oauth2.Token, error) { - f, err := os.Open(file) + f, err := os.Open(filepath.Clean(file)) if err != nil { return nil, err } diff --git a/modules/textfile/widget.go b/modules/textfile/widget.go index 51d39e9c..048d2ded 100644 --- a/modules/textfile/widget.go +++ b/modules/textfile/widget.go @@ -5,6 +5,7 @@ import ( "fmt" "io/ioutil" "os" + "path/filepath" "time" "github.com/alecthomas/chroma/formatters" @@ -91,7 +92,7 @@ func (widget *Widget) content() (string, string, bool) { func (widget *Widget) formattedText() string { filePath, _ := utils.ExpandHomeDir(widget.CurrentSource()) - file, err := os.Open(filePath) + file, err := os.Open(filepath.Clean(filePath)) if err != nil { return err.Error() } @@ -124,9 +125,9 @@ func (widget *Widget) formattedText() string { } func (widget *Widget) plainText() string { - filePath, _ := utils.ExpandHomeDir(widget.CurrentSource()) + filePath, _ := utils.ExpandHomeDir(filepath.Clean(widget.CurrentSource())) - text, err := ioutil.ReadFile(filePath) + text, err := ioutil.ReadFile(filepath.Clean(filePath)) if err != nil { return err.Error() } diff --git a/utils/utils.go b/utils/utils.go index 953d9c1d..9caaec10 100644 --- a/utils/utils.go +++ b/utils/utils.go @@ -8,6 +8,7 @@ import ( "io/ioutil" "os" "os/exec" + "path/filepath" "regexp" "runtime" "strings" @@ -127,7 +128,7 @@ func OpenFile(path string) { // ReadFileBytes reads the contents of a file and returns those contents as a slice of bytes func ReadFileBytes(filePath string) ([]byte, error) { - fileData, err := ioutil.ReadFile(filePath) + fileData, err := ioutil.ReadFile(filepath.Clean(filePath)) if err != nil { return []byte{}, err } diff --git a/view/bargraph.go b/view/bargraph.go index 3a08d8c0..34fc25d1 100644 --- a/view/bargraph.go +++ b/view/bargraph.go @@ -82,7 +82,7 @@ func BuildStars(data []Bar, maxStars int, starChar string) string { } //write the line - buffer.WriteString( + _, err := buffer.WriteString( fmt.Sprintf( "%s%s[[%s]%s[default]%s] %s\n", bar.Label, @@ -93,6 +93,9 @@ func BuildStars(data []Bar, maxStars int, starChar string) string { label, ), ) + if err != nil { + return "" + } } return buffer.String()