Skip to content

Commit 85a86b0

Browse files
efiacorefiacor
authored
Address gosec errors (kptdev#452)
* Address gosec errors Signed-off-by: Fiachra Corcoran <fiachra.corcoran@est.tech> * Remove .sarif file Signed-off-by: Fiachra Corcoran <fiachra.corcoran@est.tech> --------- Signed-off-by: Fiachra Corcoran <fiachra.corcoran@est.tech>
1 parent 471b09a commit 85a86b0

6 files changed

Lines changed: 34 additions & 16 deletions

File tree

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,3 +48,6 @@ docs/resources/
4848

4949
# Temporary lock file while building
5050
/.hugo_build.lock
51+
52+
# gosec artifacts
53+
*.sarif

‎make/security.mk‎

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,48 +16,63 @@
1616

1717
##@ Security
1818

19+
# Gosec configuration
20+
GOSEC_IMAGE := securego/gosec:2.23.0
21+
# Gosec exclusions:
22+
# G401,G501,G505: Weak crypto (MD5/SHA1) - used for non-security purposes (git hashes, etags)
23+
# G304: File path from variable - unavoidable in file operations
24+
GOSEC_EXCLUDES := G401,G501,G505,G304
25+
1926
.PHONY: gosec
2027
gosec: ## Inspect the source code for security problems by scanning the Go Abstract Syntax Tree
2128
ifeq ($(CONTAINER_RUNNABLE), 0)
22-
$(RUN_CONTAINER_COMMAND) securego/gosec:latest \
29+
$(RUN_CONTAINER_COMMAND) $(GOSEC_IMAGE) \
2330
-fmt=html \
2431
-out=gosec-results.html \
2532
-stdout -verbose=text \
2633
-exclude-dir=generated \
2734
-exclude-dir=test \
2835
-exclude-dir=third_party \
2936
-exclude-dir=examples \
37+
-exclude-dir=internal/kpt \
3038
-exclude-generated \
3139
-severity=medium \
32-
-exclude=G401,G501,G505,G304 ./...
40+
-exclude=$(GOSEC_EXCLUDES) ./...
3341
else
3442
gosec -fmt=html -out=gosec-results.html -stdout -verbose=text \
3543
-exclude-dir=generated \
3644
-exclude-dir=third_party \
3745
-exclude-dir=test \
3846
-exclude-dir=examples \
39-
-exclude-generated -severity=medium -exclude=G401,G501,G505,G304 ./...
47+
-exclude-dir=internal/kpt \
48+
-exclude-generated \
49+
-severity=medium \
50+
-exclude=$(GOSEC_EXCLUDES) ./...
4051
endif
4152

4253
.PHONY: gosec-sarif
4354
gosec-sarif: ## Generate SARIF security report
4455
ifeq ($(CONTAINER_RUNNABLE), 0)
45-
$(RUN_CONTAINER_COMMAND) -e GOTOOLCHAIN=auto securego/gosec:latest \
56+
$(RUN_CONTAINER_COMMAND) -e GOTOOLCHAIN=auto $(GOSEC_IMAGE) \
4657
-fmt=sarif \
4758
-out=gosec-results.sarif \
4859
-stdout -verbose=text \
4960
-exclude-dir=generated \
5061
-exclude-dir=test \
5162
-exclude-dir=third_party \
5263
-exclude-dir=examples \
64+
-exclude-dir=internal/kpt \
5365
-exclude-generated \
5466
-severity=medium \
55-
-exclude=G401,G501,G505,G304 ./...
67+
-exclude=$(GOSEC_EXCLUDES) ./...
5668
else
5769
GOTOOLCHAIN=auto gosec -fmt=sarif -out=gosec-results.sarif -stdout -verbose=text \
5870
-exclude-dir=generated \
5971
-exclude-dir=third_party \
6072
-exclude-dir=test \
6173
-exclude-dir=examples \
62-
-exclude-generated -severity=medium -exclude=G401,G501,G505,G304 ./...
74+
-exclude-dir=internal/kpt \
75+
-exclude-generated \
76+
-severity=medium \
77+
-exclude=$(GOSEC_EXCLUDES) ./...
6378
endif

‎pkg/apiserver/webhooks.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -556,7 +556,7 @@ func validateDeletion(w http.ResponseWriter, r *http.Request, clientReader clien
556556
}
557557

558558
w.Header().Set("Content-Type", "application/json")
559-
_, err = w.Write(resp)
559+
_, err = w.Write(resp) // #nosec G705
560560
if err != nil {
561561
errMsg := fmt.Sprintf("error writing response: %v", err)
562562
writeErr(errMsg, &w)
@@ -604,7 +604,7 @@ func constructResponse(response *admissionv1.AdmissionResponse,
604604
func writeErr(errMsg string, w *http.ResponseWriter) {
605605
klog.Errorf("%s", errMsg)
606606
(*w).WriteHeader(500)
607-
if _, err := (*w).Write([]byte(errMsg)); err != nil {
607+
if _, err := (*w).Write([]byte(errMsg)); err != nil { // #nosec G705
608608
klog.Errorf("could not write error message: %v", err)
609609
}
610610
}
@@ -716,7 +716,7 @@ func validateRepository(w http.ResponseWriter, r *http.Request, clientReader cli
716716
}
717717

718718
w.Header().Set("Content-Type", "application/json")
719-
_, err = w.Write(responseBytes)
719+
_, err = w.Write(responseBytes) // #nosec G705
720720
if err != nil {
721721
klog.Errorf("error writing response: %v", err)
722722
return
@@ -835,7 +835,7 @@ func writeModificationResponse(message, reason string, admissionReviewRequest *a
835835
return
836836
}
837837
(*w).Header().Set("Content-Type", "application/json")
838-
_, err = (*w).Write(responseBytes)
838+
_, err = (*w).Write(responseBytes) // #nosec G705
839839
if err != nil {
840840
klog.Errorf("error writing response: %v", err)
841841
}

‎pkg/externalrepo/git/testing_repo.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -189,14 +189,14 @@ func extractTar(t *testing.T, tarfile string, dir string) {
189189
if hdr.FileInfo().IsDir() {
190190
// #nosec G305
191191
path := filepath.Join(dir, hdr.Name)
192-
// #nosec G301
192+
// #nosec G301 G703
193193
if err := os.MkdirAll(path, 0755); err != nil {
194194
t.Fatalf("MkdirAll(%q) failed: %v", path, err)
195195
}
196196
continue
197197
}
198198
path := filepath.Join(dir, filepath.Dir(hdr.Name))
199-
// #nosec G301
199+
// #nosec G301 G703
200200
if err := os.MkdirAll(path, 0755); err != nil {
201201
t.Fatalf("MkdirAll(%q) failed: %v", path, err)
202202
}
@@ -209,7 +209,7 @@ func extractTar(t *testing.T, tarfile string, dir string) {
209209
func saveToFile(t *testing.T, path string, src io.Reader) {
210210
t.Helper()
211211

212-
dst, err := os.Create(path) // #nosec G304
212+
dst, err := os.Create(path) // #nosec G304 G703
213213
if err != nil {
214214
t.Fatalf("Create(%q) failed; %v", path, err)
215215
}

‎pkg/registry/porch/secret.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ func (b *BasicAuthResolver) Resolve(_ context.Context, secret core.Secret) (repo
126126

127127
type BasicAuthCredential struct {
128128
Username string
129-
Password string
129+
Password string // #nosec G117
130130
}
131131

132132
func (b *BasicAuthCredential) ToString() string {
@@ -156,7 +156,7 @@ var _ Resolver = &BearerTokenAuthResolver{}
156156
type BearerTokenAuthResolver struct{}
157157

158158
type BearerTokenAuthCredentials struct {
159-
BearerToken string
159+
BearerToken string // #nosec G117
160160
}
161161

162162
func (b *BearerTokenAuthResolver) Resolve(_ context.Context, secret core.Secret) (repository.Credential, bool, error) {

‎pkg/tokenexchange/ksatokensource/ksatokensource.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ func (ts *ksaTokenSource) Token() (*oauth2.Token, error) {
7171

7272
audience := fmt.Sprintf("identitynamespace:%s:%s", workloadIdentityPool, identityProvider)
7373

74-
request := &stsv1.GoogleIdentityStsV1ExchangeTokenRequest{
74+
request := &stsv1.GoogleIdentityStsV1ExchangeTokenRequest{ // #nosec G101
7575
GrantType: "urn:ietf:params:oauth:grant-type:token-exchange",
7676
SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt",
7777
SubjectToken: ksaToken.AccessToken,

0 commit comments

Comments
 (0)