Skip to content

Enable gosec in CI, takes ~50sec so make it separate job. #738

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bogdandrutu merged 2 commits into from
Mar 28, 2020
Merged

Enable gosec in CI, takes ~50sec so make it separate job. #738

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ae05bc0
Enable gosec in CI, takes ~50sec so make it separate job.
bogdandrutu Mar 28, 2020
64e8ab1
Merge branch 'master' into gosecbetter
bogdandrutu Mar 28, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,9 @@ workflows:
- test:
requires:
- setup-and-lint
- gosec:
requires:
- setup-and-lint
- coverage:
requires:
- setup-and-lint
Expand All @@ -55,6 +58,7 @@ workflows:
- cross-compile
- loadtest
- test
- gosec
- coverage
filters:
branches:
Expand All @@ -66,6 +70,7 @@ workflows:
- cross-compile
- loadtest
- test
- gosec
- coverage
filters:
branches:
Expand Down Expand Up @@ -143,6 +148,14 @@ jobs:
command: make test
- save_module_cache

gosec:
executor: golang
steps:
- attach_to_workspace
- run:
name: Golang Security Checker
command: make lint-gosec

coverage:
executor: golang
steps:
Expand Down
3 changes: 2 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,8 @@ misspell-correction:

.PHONY: lint-gosec
lint-gosec:
$(GOSEC) -quiet -exclude=G104,G107 ./...
# TODO: Consider to use gosec from golangci-lint
$(GOSEC) -quiet -exclude=G104 ./...

.PHONY: lint-static-check
lint-static-check:
Expand Down
1 change: 1 addition & 0 deletions exporter/otlpexporter/connection.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ func (e *exporterImp) saveLastConnectError(err error) {
if err != nil {
errPtr = &err
}
// #nosec
atomic.StorePointer(&e.lastConnectErrPtr, unsafe.Pointer(errPtr))
}

Expand Down
2 changes: 1 addition & 1 deletion extension/pprofextension/pprofextension.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ package pprofextension
import (
"net"
"net/http"
_ "net/http/pprof" // Needed to enable the performance profiler
_ "net/http/pprof" // #nosec Needed to enable the performance profiler
"os"
"runtime"
"runtime/pprof"
Expand Down
1 change: 1 addition & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -969,6 +969,7 @@ github.com/segmentio/analytics-go v3.1.0+incompatible/go.mod h1:C7CYBtQWk4vRk2Ry
github.com/segmentio/backo-go v0.0.0-20160424052352-204274ad699c/go.mod h1:kJ9mm9YmoWSkk+oQ+5Cj8DEoRCX2JT6As4kEtIIOp1M=
github.com/serenize/snaker v0.0.0-20171204205717-a683aaf2d516/go.mod h1:Yow6lPLSAXx2ifx470yD/nUe22Dv5vBvxK/UK9UUTVs=
github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
github.com/shirou/gopsutil v0.0.0-20190901111213-e4ec7b275ada h1:WokF3GuxBeL+n4Lk4Fa8v9mbdjlrl7bHuneF4N1bk2I=
github.com/shirou/gopsutil v0.0.0-20190901111213-e4ec7b275ada/go.mod h1:WWnYX4lzhCH5h/3YBfyVA3VbLYjlMZZAQcW9ojMexNc=
github.com/shirou/w32 v0.0.0-20160930032740-bb4de0191aa4/go.mod h1:qsXQc7+bwAM3Q1u/4XEfrquwF8Lw7D7y5cD8CuHnfIc=
github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
Expand Down
2 changes: 2 additions & 0 deletions processor/attributesprocessor/attribute_hasher.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
package attributesprocessor

import (
// #nosec
"crypto/sha1"
"encoding/binary"
"encoding/hex"
Expand Down Expand Up @@ -58,6 +59,7 @@ func SHA1AttributeHahser(attr *tracepb.AttributeValue) *tracepb.AttributeValue {

var hashed string
if len(val) > 0 {
// #nosec
Copy link
Member

@yurishkuro yurishkuro Mar 29, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I recommend adding explanations in the comments. In the case of unsafe pointer above it's more obvious, but not here.

h := sha1.New()
h.Write(val)
val = h.Sum(nil)
Expand Down
1 change: 1 addition & 0 deletions testbed/testbed/child_process.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,7 @@ func (cp *childProcess) start(params startParams) error {
log.Printf("Writing %s log to %s", cp.name, params.logFilePath)

// Prepare to start the process.
// #nosec
cp.cmd = exec.Command(params.cmd, params.cmdArgs...)

// Capture standard output and standard error.
Expand Down