Skip to content

Commit 0d16344

Browse files
kim-tsaokim-tsao
authored
enable gosec (#969)
* enable gosec Signed-off-by: Kim Tsao <ktsao@redhat.com> * Fix G601 errors Signed-off-by: Kim Tsao <ktsao@redhat.com> * Fix warnings Signed-off-by: Kim Tsao <ktsao@redhat.com> * Add newline Signed-off-by: Kim Tsao <ktsao@redhat.com> Signed-off-by: Kim Tsao <ktsao@redhat.com>
1 parent fe7c10e commit 0d16344

File tree

8 files changed

+47
-3
lines changed

8 files changed

+47
-3
lines changed

‎.github/workflows/ci.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,3 +70,20 @@ jobs:
7070
run: |
7171
go fmt -x ./...
7272
git diff --exit-code || { echo 'Go sources need to be formatted. Execute "go fmt -x ./..." locally in the 'generator' folder and commit changes to fix an issue'; exit 1; }
73+
74+
- name: Run Gosec Security Scanner
75+
run: |
76+
export PATH=$PATH:$(go env GOPATH)/bin
77+
go install github.com/securego/gosec/v2/cmd/gosec@latest
78+
./run_gosec.sh
79+
if [[ $? != 0 ]]
80+
then
81+
echo "gosec scanner failed to run "
82+
exit 1
83+
fi
84+
85+
- name: Upload SARIF file
86+
uses: github/codeql-action/upload-sarif@v2
87+
with:
88+
# Path to SARIF file relative to the root of the repository
89+
sarif_file: gosec.sarif

‎pkg/apis/workspaces/v1alpha1/component_plugin_conversion.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ func convertPluginComponentTo_v1alpha2(srcComponent *Component, destComponent *v
2727
destComponent.Name = pluginKey
2828

2929
for _, srcCommand := range src.Commands {
30+
srcCommand := srcCommand
3031
if srcCommand.Custom != nil {
3132
// v1alpha2 does not support Plugin Custom commands, so we have to drop them here
3233
continue
@@ -40,6 +41,7 @@ func convertPluginComponentTo_v1alpha2(srcComponent *Component, destComponent *v
4041
}
4142

4243
for _, srcComponent := range src.Components {
44+
srcComponent := srcComponent
4345
destComponent := v1alpha2.ComponentPluginOverride{}
4446
err := convertPluginComponentSubComponentTo_v1alpha2(&srcComponent, &destComponent)
4547
if err != nil {
@@ -101,6 +103,7 @@ func convertPluginComponentFrom_v1alpha2(srcComponent *v1alpha2.Component, destC
101103
destComponent.Plugin.Name = srcComponent.Name
102104

103105
for _, srcCommand := range src.Commands {
106+
srcCommand := srcCommand
104107
destCommand := Command{}
105108
err := convertPluginComponentCommandFrom_v1alpha2(&srcCommand, &destCommand)
106109
if err != nil {
@@ -110,6 +113,7 @@ func convertPluginComponentFrom_v1alpha2(srcComponent *v1alpha2.Component, destC
110113
}
111114

112115
for _, srcComponent := range src.Components {
116+
srcComponent := srcComponent
113117
destComponent := PluginComponentsOverride{}
114118
err := convertPluginComponentSubComponentFrom_v1alpha2(&srcComponent, &destComponent)
115119
if err != nil {

‎pkg/apis/workspaces/v1alpha1/conversion.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ func convertDevWorkspaceTemplateSpecTo_v1alpha2(src *DevWorkspaceTemplateSpec, d
5555
}
5656
}
5757
for _, srcComponent := range src.Components {
58+
srcComponent := srcComponent
5859
destComponent := v1alpha2.Component{}
5960
err := convertComponentTo_v1alpha2(&srcComponent, &destComponent)
6061
if err != nil {
@@ -63,6 +64,7 @@ func convertDevWorkspaceTemplateSpecTo_v1alpha2(src *DevWorkspaceTemplateSpec, d
6364
dest.Components = append(dest.Components, destComponent)
6465
}
6566
for _, srcProject := range src.Projects {
67+
srcProject := srcProject
6668
destProject := v1alpha2.Project{}
6769
err := convertProjectTo_v1alpha2(&srcProject, &destProject)
6870
if err != nil {
@@ -71,6 +73,7 @@ func convertDevWorkspaceTemplateSpecTo_v1alpha2(src *DevWorkspaceTemplateSpec, d
7173
dest.Projects = append(dest.Projects, destProject)
7274
}
7375
for _, srcStarterProject := range src.StarterProjects {
76+
srcStarterProject := srcStarterProject
7477
destStarterProject := v1alpha2.StarterProject{}
7578
err := convertStarterProjectTo_v1alpha2(&srcStarterProject, &destStarterProject)
7679
if err != nil {
@@ -79,6 +82,7 @@ func convertDevWorkspaceTemplateSpecTo_v1alpha2(src *DevWorkspaceTemplateSpec, d
7982
dest.StarterProjects = append(dest.StarterProjects, destStarterProject)
8083
}
8184
for _, srcCommand := range src.Commands {
85+
srcCommand := srcCommand
8286
destCommand := v1alpha2.Command{}
8387
err := convertCommandTo_v1alpha2(&srcCommand, &destCommand)
8488
if err != nil {
@@ -105,6 +109,7 @@ func convertDevWorkspaceTemplateSpecFrom_v1alpha2(src *v1alpha2.DevWorkspaceTemp
105109
}
106110
}
107111
for _, srcComponent := range src.Components {
112+
srcComponent := srcComponent
108113
destComponent := Component{}
109114
err := convertComponentFrom_v1alpha2(&srcComponent, &destComponent)
110115
if err != nil {
@@ -113,6 +118,7 @@ func convertDevWorkspaceTemplateSpecFrom_v1alpha2(src *v1alpha2.DevWorkspaceTemp
113118
dest.Components = append(dest.Components, destComponent)
114119
}
115120
for _, srcProject := range src.Projects {
121+
srcProject := srcProject
116122
destProject := Project{}
117123
err := convertProjectFrom_v1alpha2(&srcProject, &destProject)
118124
if err != nil {
@@ -121,6 +127,7 @@ func convertDevWorkspaceTemplateSpecFrom_v1alpha2(src *v1alpha2.DevWorkspaceTemp
121127
dest.Projects = append(dest.Projects, destProject)
122128
}
123129
for _, srcStarterProject := range src.StarterProjects {
130+
srcStarterProject := srcStarterProject
124131
destStarterProject := StarterProject{}
125132
err := convertStarterProjectFrom_v1alpha2(&srcStarterProject, &destStarterProject)
126133
if err != nil {
@@ -129,6 +136,7 @@ func convertDevWorkspaceTemplateSpecFrom_v1alpha2(src *v1alpha2.DevWorkspaceTemp
129136
dest.StarterProjects = append(dest.StarterProjects, destStarterProject)
130137
}
131138
for _, srcCommand := range src.Commands {
139+
srcCommand := srcCommand
132140
destCommand := Command{}
133141
err := convertCommandFrom_v1alpha2(&srcCommand, &destCommand)
134142
if err != nil {

‎pkg/apis/workspaces/v1alpha1/parent_conversion.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ func convertParentTo_v1alpha2(src *Parent, dest *v1alpha2.Parent) error {
1717
}
1818

1919
for _, srcCommand := range src.Commands {
20+
srcCommand := srcCommand
2021
if srcCommand.Custom != nil {
2122
// v1alpha2 does not support Parent Custom commands, so we have to drop them here
2223
continue
@@ -30,6 +31,7 @@ func convertParentTo_v1alpha2(src *Parent, dest *v1alpha2.Parent) error {
3031
}
3132

3233
for _, srcComponent := range src.Components {
34+
srcComponent := srcComponent
3335
if srcComponent.Custom != nil {
3436
// v1alpha2 does not support Parent Custom Components, so we have to drop them here
3537
continue
@@ -43,6 +45,7 @@ func convertParentTo_v1alpha2(src *Parent, dest *v1alpha2.Parent) error {
4345
}
4446

4547
for _, srcProject := range src.Projects {
48+
srcProject := srcProject
4649
destProject := v1alpha2.Project{}
4750
err := convertProjectTo_v1alpha2(&srcProject, &destProject)
4851
if err != nil {
@@ -61,6 +64,7 @@ func convertParentTo_v1alpha2(src *Parent, dest *v1alpha2.Parent) error {
6164
}
6265

6366
for _, srcProject := range src.StarterProjects {
67+
srcProject := srcProject
6468
destProject := v1alpha2.StarterProject{}
6569
err := convertStarterProjectTo_v1alpha2(&srcProject, &destProject)
6670
if err != nil {
@@ -146,6 +150,7 @@ func convertParentFrom_v1alpha2(src *v1alpha2.Parent, dest *Parent) error {
146150
dest.Kubernetes = &kube
147151
}
148152
for _, srcCommand := range src.Commands {
153+
srcCommand := srcCommand
149154
destCommand := Command{}
150155
err := convertParentCommandFrom_v1alpha2(&srcCommand, &destCommand)
151156
if err != nil {
@@ -155,6 +160,7 @@ func convertParentFrom_v1alpha2(src *v1alpha2.Parent, dest *Parent) error {
155160
}
156161

157162
for _, srcComponent := range src.Components {
163+
srcComponent := srcComponent
158164
destComponent := Component{}
159165
err := convertParentComponentFrom_v1alpha2(&srcComponent, &destComponent)
160166
if err != nil {

‎pkg/apis/workspaces/v1alpha1/union_implementation.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ func visitUnion(union interface{}, visitor interface{}) (err error) {
3434
}
3535

3636
func simplifyUnion(union Union, visitorType reflect.Type) {
37-
normalizeUnion(union, visitorType)
37+
_ = normalizeUnion(union, visitorType)
3838
*union.discriminator() = ""
3939
}
4040

‎pkg/apis/workspaces/v1alpha2/union_implementation.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ func visitUnion(union interface{}, visitor interface{}) (err error) {
3434
}
3535

3636
func simplifyUnion(union Union, visitorType reflect.Type) {
37-
normalizeUnion(union, visitorType)
37+
_ = normalizeUnion(union, visitorType)
3838
*union.discriminator() = ""
3939
}
4040

‎pkg/utils/unions/normalize.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ func (n *normalizer) Struct(s reflect.Value) error {
1616
if addr.CanInterface() {
1717
i := addr.Interface()
1818
if u, ok := i.(dw.Union); ok {
19-
u.Normalize()
19+
_ = u.Normalize()
2020
}
2121
}
2222
}

‎run_gosec.sh

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
# This script runs the gosec scanner locally
3+
4+
if ! command -v gosec 2> /dev/null
5+
then
6+
echo "error gosec must be installed with this command: go install github.com/securego/gosec/v2/cmd/gosec@latest" && exit 1
7+
fi
8+
9+
gosec -no-fail -fmt=sarif -out=gosec.sarif -exclude-dir test -exclude-dir generator ./...

0 commit comments

Comments
 (0)