taigrr/wtf
1
0
Fork 0
mirror of https://github.com/taigrr/wtf synced 2025-01-18 04:03:14 -08:00
Code Issues Projects Releases Wiki Activity

20191217 gosec (#796)

Browse Source 
* Add gosec to the Makefile

Signed-off-by: Chris Cummer <chriscummer@me.com>

* Fix some issues found by gosec

Signed-off-by: Chris Cummer <chriscummer@me.com>
This commit is contained in:
Chris Cummer 2019-12-17 14:59:16 -08:00 committed by GitHub
parent cde904ff08
commit 10f761dbcb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
11 changed files with 50 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Makefile
View File

@ -48,6 +48,10 @@ coverage:
go test -coverprofile=coverage.out ./...
go tool cover -html=coverage.out
## gosec: runs the gosec static security scanner against the source code
gosec:
gosec -tests ./...
## help: prints this help message
help:
@echo "Usage: \n"
@ -104,14 +108,14 @@ lint:
staticcheck ./wtf
staticcheck ./main.go
## loc: displays the lines of code (LoC) count
loc:
@loc --exclude _sample_configs/ _site/ docs/ Makefile *.md
## run: executes the locally-installed version
run: build
bin/${APP}
## size: displays the lines of code (LoC) count
size:
@loc --exclude _sample_configs/ _site/ docs/ Makefile *.md
## test: runs the test suite
test: build
go test ./...

2
cfg/copy.go
View File

@ -40,7 +40,7 @@ func fcopy(src, dest string, info os.FileInfo) error {
return err
}
s, err := os.Open(src)
s, err := os.Open(filepath.Clean(src))
if err != nil {
return err
}

7
go.mod
View File

@ -24,6 +24,7 @@ require (
github.com/gdamore/tcell v1.3.0
github.com/go-ole/go-ole v1.2.4 // indirect
github.com/godbus/dbus v4.1.0+incompatible // indirect
github.com/golang/protobuf v1.3.2 // indirect
github.com/google/go-github/v26 v26.1.3
github.com/gophercloud/gophercloud v0.5.0 // indirect
github.com/hashicorp/go-cleanhttp v0.5.1 // indirect
@ -37,7 +38,8 @@ require (
github.com/mmcdole/goxpp v0.0.0-20181012175147-0068e33feabf // indirect
github.com/olebedev/config v0.0.0-20190528211619-364964f3a8e4
github.com/olekukonko/tablewriter v0.0.4
github.com/onsi/ginkgo v1.10.2 // indirect
github.com/onsi/ginkgo v1.10.3 // indirect
github.com/onsi/gomega v1.7.1 // indirect
github.com/opencontainers/go-digest v1.0.0-rc1 // indirect
github.com/pkg/errors v0.8.1
github.com/pkg/profile v1.4.0
@ -51,8 +53,11 @@ require (
github.com/zmb3/spotify v0.0.0-20191010212056-e12fb981aacb
github.com/zorkian/go-datadog-api v2.25.0+incompatible
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 // indirect
golang.org/x/net v0.0.0-20190923162816-aa69164e4478 // indirect
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 // indirect
google.golang.org/api v0.14.0
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
gopkg.in/jarcoal/httpmock.v1 v1.0.0-20181110093347-3be5f16b70eb // indirect
gopkg.in/yaml.v2 v2.2.7
k8s.io/api v0.0.0-20191010143144-fbf594f18f80 // indirect

14
go.sum
View File

@ -107,6 +107,8 @@ github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
github.com/golang/protobuf v1.3.1 h1:YF8+flBXS5eO826T4nzqPrxfhQThhXl0YzfuUPu4SBg=
github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
github.com/google/btree v0.0.0-20160524151835-7d79101e329e/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@ -207,12 +209,14 @@ github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.10.1 h1:q/mM8GF/n0shIN8SaAZ0V+jnLPzen6WIVZdiwrRlMlo=
github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.10.2 h1:uqH7bpe+ERSiDa34FDOF7RikN6RzXgduUF8yarlZp94=
github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.10.3 h1:OoxbjfXVZyod1fmWYhI7SEyaD8B00ynP3T+D5GiyHOY=
github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
github.com/onsi/gomega v0.0.0-20190113212917-5533ce8a0da3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME=
github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
github.com/onsi/gomega v1.7.1 h1:K0jcRCwNQM3vFGh1ppMtDh/+7ApJrjldlX8fA0jDTLQ=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/opencontainers/go-digest v1.0.0-rc1 h1:WzifXhOVOEOuFYOJAW6aQqW0TooG2iki3E3Ii+WN7gQ=
github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
@ -289,6 +293,8 @@ golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc h1:gkKoSkUmnU6bpS/VhkuO27bzQeSA51uaEfbOW5dNb68=
golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20190923162816-aa69164e4478 h1:l5EDrHhldLYb3ZRHDUhXF7Om7MvYXnkV9/iQNo1lX6g=
golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@ -312,6 +318,8 @@ golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7w
golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190626150813-e07cf5db2756 h1:9nuHUbU8dRnRRfj9KjWUVrJeoexdbeMjttk6Oh1rD10=
golang.org/x/sys v0.0.0-20190626150813-e07cf5db2756/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190922100055-0a153f010e69 h1:rOhMmluY6kLMhdnrivzec6lLgaVbMHMn2ISQXJeJ5EM=
golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@ -351,6 +359,8 @@ google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiq
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
gopkg.in/inf.v0 v0.9.0 h1:3zYtXIO92bvsdS3ggAdA8Gb4Azj0YU+TVY1uGYNFA8o=

5
modules/cmdrunner/widget.go
View File

@ -128,7 +128,10 @@ func runCommandLoop(widget *Widget) {
// The command has exited, print any error messages
if err != nil {
widget.m.Lock()
widget.buffer.WriteString(err.Error())
_, err := widget.buffer.WriteString(err.Error())
if err != nil {
return
}
widget.m.Unlock()
}
widget.redrawChan <- true

9
modules/gcal/client.go
View File

@ -15,6 +15,7 @@ import (
"log"
"net/http"
"os"
"path/filepath"
"sort"
"time"
@ -33,7 +34,7 @@ func (widget *Widget) Fetch() ([]*CalEvent, error) {
secretPath, _ := utils.ExpandHomeDir(widget.settings.secretFile)
b, err := ioutil.ReadFile(secretPath)
b, err := ioutil.ReadFile(filepath.Clean(secretPath))
if err != nil {
return nil, err
}
@ -125,9 +126,9 @@ func isAuthenticated() bool {
}
func (widget *Widget) authenticate() {
secretPath, _ := utils.ExpandHomeDir(widget.settings.secretFile)
secretPath, _ := utils.ExpandHomeDir(filepath.Clean(widget.settings.secretFile))
b, err := ioutil.ReadFile(secretPath)
b, err := ioutil.ReadFile(filepath.Clean(secretPath))
if err != nil {
log.Fatalf("Unable to read secret file. %v", widget.settings.secretFile)
}
@ -166,7 +167,7 @@ func tokenCacheFile() (string, error) {
// tokenFromFile retrieves a Token from a given file path.
// It returns the retrieved Token and any read error encountered.
func tokenFromFile(file string) (*oauth2.Token, error) {
f, err := os.Open(file)
f, err := os.Open(filepath.Clean(file))
if err != nil {
return nil, err
}

3
modules/googleanalytics/client.go
View File

@ -6,6 +6,7 @@ import (
"io/ioutil"
"log"
"net/http"
"path/filepath"
"time"
"github.com/wtfutil/wtf/utils"
@ -47,7 +48,7 @@ func (widget *Widget) Fetch() []websiteReport {
}
func buildNetClient(secretPath string) *http.Client {
clientSecret, err := ioutil.ReadFile(secretPath)
clientSecret, err := ioutil.ReadFile(filepath.Clean(secretPath))
if err != nil {
log.Fatalf("Unable to read secretPath. %v", err)
}

4
modules/gspreadsheets/client.go
View File

@ -32,7 +32,7 @@ func (widget *Widget) Fetch() ([]*sheets.ValueRange, error) {
secretPath, _ := utils.ExpandHomeDir(widget.settings.secretFile)
b, err := ioutil.ReadFile(secretPath)
b, err := ioutil.ReadFile(filepath.Clean(secretPath))
if err != nil {
log.Fatalf("Unable to read secretPath. %v", err)
return nil, err
@ -125,7 +125,7 @@ func tokenCacheFile() (string, error) {
// tokenFromFile retrieves a Token from a given file path.
// It returns the retrieved Token and any read error encountered.
func tokenFromFile(file string) (*oauth2.Token, error) {
f, err := os.Open(file)
f, err := os.Open(filepath.Clean(file))
if err != nil {
return nil, err
}

7
modules/textfile/widget.go
View File

@ -5,6 +5,7 @@ import (
"fmt"
"io/ioutil"
"os"
"path/filepath"
"time"
"github.com/alecthomas/chroma/formatters"
@ -91,7 +92,7 @@ func (widget *Widget) content() (string, string, bool) {
func (widget *Widget) formattedText() string {
filePath, _ := utils.ExpandHomeDir(widget.CurrentSource())
file, err := os.Open(filePath)
file, err := os.Open(filepath.Clean(filePath))
if err != nil {
return err.Error()
}
@ -124,9 +125,9 @@ func (widget *Widget) formattedText() string {
}
func (widget *Widget) plainText() string {
filePath, _ := utils.ExpandHomeDir(widget.CurrentSource())
filePath, _ := utils.ExpandHomeDir(filepath.Clean(widget.CurrentSource()))
text, err := ioutil.ReadFile(filePath)
text, err := ioutil.ReadFile(filepath.Clean(filePath))
if err != nil {
return err.Error()
}

3
utils/utils.go
View File

@ -8,6 +8,7 @@ import (
"io/ioutil"
"os"
"os/exec"
"path/filepath"
"regexp"
"runtime"
"strings"
@ -127,7 +128,7 @@ func OpenFile(path string) {
// ReadFileBytes reads the contents of a file and returns those contents as a slice of bytes
func ReadFileBytes(filePath string) ([]byte, error) {
fileData, err := ioutil.ReadFile(filePath)
fileData, err := ioutil.ReadFile(filepath.Clean(filePath))
if err != nil {
return []byte{}, err
}

5
view/bargraph.go
View File

@ -82,7 +82,7 @@ func BuildStars(data []Bar, maxStars int, starChar string) string {
}
//write the line
buffer.WriteString(
_, err := buffer.WriteString(
fmt.Sprintf(
"%s%s[[%s]%s[default]%s] %s\n",
bar.Label,
@ -93,6 +93,9 @@ func BuildStars(data []Bar, maxStars int, starChar string) string {
label,
),
)
if err != nil {
return ""
}
}
return buffer.String()