From df3f80e8b53497e4cf3c8d2ebcb49ab4aefd0ab5 Mon Sep 17 00:00:00 2001 From: Pablo Caderno Date: Wed, 26 Oct 2022 17:34:40 +1100 Subject: [PATCH 1/2] feat: added gosec G103 Signed-off-by: Pablo Caderno --- .golangci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.golangci.yml b/.golangci.yml index 88dd50758e852..7aab38ca1e794 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -50,6 +50,7 @@ issues: linters-settings: gosec: includes: + - G103 - G102 - G303 - G601 From d1d0da1f71c1621cebca1c76e50b46afc8400055 Mon Sep 17 00:00:00 2001 From: Pablo Caderno Date: Thu, 27 Oct 2022 09:36:58 +1100 Subject: [PATCH 2/2] fix: fixed gosec warnings Signed-off-by: Pablo Caderno --- central/idmap/shared_storage.go | 3 +++ pkg/concurrency/error_signal.go | 4 ++++ pkg/concurrency/signal.go | 1 + pkg/concurrency/value_stream.go | 2 ++ pkg/grpc/authn/basic/manager.go | 2 ++ pkg/grpc/util/lazy_conn.go | 2 ++ pkg/protoreflect/slice_id.go | 1 + pkg/sac/effectiveaccessscope/conversion.go | 1 + pkg/testutils/full_init.go | 1 + sensor/admission-control/manager/manager_impl.go | 1 + 10 files changed, 18 insertions(+) diff --git a/central/idmap/shared_storage.go b/central/idmap/shared_storage.go index efb1e37ad75ec..a47c3a91d02bf 100644 --- a/central/idmap/shared_storage.go +++ b/central/idmap/shared_storage.go @@ -19,6 +19,7 @@ type sharedIDMapStorage struct { // newSharedIDMapStorage creates a new shared storage for an ID map. func newSharedIDMapStorage() *sharedIDMapStorage { return &sharedIDMapStorage{ + //#nosec G103 shared: unsafe.Pointer(NewIDMap()), } } @@ -31,6 +32,7 @@ func (s *sharedIDMapStorage) Update(updater func(m *IDMap) bool) { if sharedInstance == nil { // If we have no shared instance, clone the current read-only instance. sharedInstance = (*IDMap)(atomic.LoadPointer(&s.readOnly)).Clone() + //#nosec G103 atomic.StorePointer(&s.shared, unsafe.Pointer(sharedInstance)) } @@ -58,6 +60,7 @@ func (s *sharedIDMapStorage) Get() *IDMap { // Claim the current shared instance as the read-only instance. m = (*IDMap)(atomic.LoadPointer(&s.shared)) + //#nosec G103 atomic.StorePointer(&s.readOnly, unsafe.Pointer(m)) atomic.StorePointer(&s.shared, nil) diff --git a/pkg/concurrency/error_signal.go b/pkg/concurrency/error_signal.go index 20822e840649c..65cbcbd8ab12e 100644 --- a/pkg/concurrency/error_signal.go +++ b/pkg/concurrency/error_signal.go @@ -114,6 +114,7 @@ func (s *errorSignalState) getErrPtr() *error { } func (s *errorSignalState) trigger(err error) bool { + //#nosec G103 if !atomic.CompareAndSwapPointer(&s.errPtr, nil, unsafe.Pointer(&err)) { return false } @@ -129,6 +130,7 @@ func newErrorSignalState() *errorSignalState { var ( defaultErrorSignalState = &errorSignalState{ + //#nosec G103 errPtr: unsafe.Pointer(&[]error{nil}[0]), signalC: closedCh, } @@ -144,6 +146,7 @@ type ErrorSignal struct { // NewErrorSignal creates and returns a new error signal. func NewErrorSignal() ErrorSignal { return ErrorSignal{ + //#nosec G103 statePtr: unsafe.Pointer(newErrorSignalState()), } } @@ -187,6 +190,7 @@ func (s *ErrorSignal) ErrorAndReset() (Error, bool) { // concurrent reset happened and succeeded, this Reset invocation will not. If the signal has been reset and // triggered in the meantime, we fail, too, pretending this Reset invocation happened as the first action in a // Reset - Trigger - Reset sequence. + //#nosec G103 if !atomic.CompareAndSwapPointer(&s.statePtr, unsafe.Pointer(rawState), unsafe.Pointer(newErrorSignalState())) { return nil, false } diff --git a/pkg/concurrency/signal.go b/pkg/concurrency/signal.go index 00afe7adf8ca2..6be30e56b26f3 100644 --- a/pkg/concurrency/signal.go +++ b/pkg/concurrency/signal.go @@ -63,6 +63,7 @@ func (s *Signal) Wait() { // actually performed (i.e., the signal was triggered). It returns false if the signal was not in the triggered state. func (s *Signal) Reset() bool { ch := make(chan struct{}) + //#nosec G103 return atomic.CompareAndSwapPointer(&s.ch, nil, unsafe.Pointer(&ch)) } diff --git a/pkg/concurrency/value_stream.go b/pkg/concurrency/value_stream.go index 42157c6d33ddc..d1ff721bd3fff 100644 --- a/pkg/concurrency/value_stream.go +++ b/pkg/concurrency/value_stream.go @@ -53,6 +53,7 @@ type ValueStream[T any] struct { // NewValueStream initializes a value stream with an initial value. func NewValueStream[T any](initVal T) *ValueStream[T] { return &ValueStream[T]{ + //#nosec G103 curr: unsafe.Pointer(&valueStreamStrictIter[T]{ valueStreamIterBase: valueStreamIterBase[T]{ currVal: initVal, @@ -172,6 +173,7 @@ func (s *ValueStream[T]) Push(val T) (T, ValueStreamIter[T]) { }, } + //#nosec G103 oldIter := (*valueStreamStrictIter[T])(atomic.SwapPointer(&s.curr, unsafe.Pointer(newIter))) oldIter.next = newIter close(oldIter.nextC) diff --git a/pkg/grpc/authn/basic/manager.go b/pkg/grpc/authn/basic/manager.go index d3c9b04eee358..597ebb0b5189e 100644 --- a/pkg/grpc/authn/basic/manager.go +++ b/pkg/grpc/authn/basic/manager.go @@ -24,6 +24,7 @@ func (m *Manager) hashFile() *htpasswd.HashFile { // SetHashFile sets the hash file to be used for basic auth. func (m *Manager) SetHashFile(hashFile *htpasswd.HashFile) { + //#nosec G103 atomic.StorePointer(&m.hashFilePtr, unsafe.Pointer(hashFile)) } @@ -50,6 +51,7 @@ func (m *Manager) IdentityForCreds(ctx context.Context, username, password strin // NewManager creates a new manager for basic authentication. func NewManager(hashFile *htpasswd.HashFile, roleMapper permissions.RoleMapper) *Manager { return &Manager{ + //#nosec G103 hashFilePtr: unsafe.Pointer(hashFile), mapper: roleMapper, } diff --git a/pkg/grpc/util/lazy_conn.go b/pkg/grpc/util/lazy_conn.go index 7389391d22486..0521a3e622b00 100644 --- a/pkg/grpc/util/lazy_conn.go +++ b/pkg/grpc/util/lazy_conn.go @@ -34,6 +34,7 @@ type LazyClientConn struct { // client conn type that returns an error right away. func NewLazyClientConn() *LazyClientConn { return &LazyClientConn{ + //#nosec G103 state: unsafe.Pointer(makeState(nil)), } } @@ -42,6 +43,7 @@ func NewLazyClientConn() *LazyClientConn { // become available will be woken up, although they might block again soon afterwards if nil was specified. func (c *LazyClientConn) Set(cc grpc.ClientConnInterface) { newState := makeState(cc) + //#nosec G103 oldState := (*lazyConnState)(atomic.SwapPointer(&c.state, unsafe.Pointer(newState))) if oldState.waitC != nil { oldState.cc = cc diff --git a/pkg/protoreflect/slice_id.go b/pkg/protoreflect/slice_id.go index 791350384324a..64f0c0073b4a6 100644 --- a/pkg/protoreflect/slice_id.go +++ b/pkg/protoreflect/slice_id.go @@ -13,6 +13,7 @@ func identityOfSlice(slice []byte) sliceIdentity { return sliceIdentity{} } return sliceIdentity{ + //#nosec G103 base: uintptr(unsafe.Pointer(&slice[0])), length: len(slice), } diff --git a/pkg/sac/effectiveaccessscope/conversion.go b/pkg/sac/effectiveaccessscope/conversion.go index 9da6ec900cc78..de59f8d1613a2 100644 --- a/pkg/sac/effectiveaccessscope/conversion.go +++ b/pkg/sac/effectiveaccessscope/conversion.go @@ -188,6 +188,7 @@ func newUnvalidatedRequirement(key string, op selection.Operator, values []strin setValue := func(fieldName string, value interface{}) { field := reqUnleashed.FieldByName(fieldName) + //#nosec G103 field = reflect.NewAt(field.Type(), unsafe.Pointer(field.UnsafeAddr())).Elem() field.Set(reflect.ValueOf(value).Elem()) } diff --git a/pkg/testutils/full_init.go b/pkg/testutils/full_init.go index e18f2f62a2dc7..885d569b09a5d 100644 --- a/pkg/testutils/full_init.go +++ b/pkg/testutils/full_init.go @@ -178,6 +178,7 @@ func fullInitStruct(structVal reflect.Value, init BasicTypeInitializer, fieldFil fieldVal := structVal.FieldByIndex(field.Index) if field.Name != "" && unicode.IsLower([]rune(field.Name)[0]) { // If a field is not exported, we need to make it writable with the following hack. + //#nosec G103 fieldVal = reflect.NewAt(fieldVal.Type(), unsafe.Pointer(fieldVal.UnsafeAddr())).Elem() } fullInitRecursive(fieldVal, init, fieldFilter, append(fieldPath, field), seenTypes) diff --git a/sensor/admission-control/manager/manager_impl.go b/sensor/admission-control/manager/manager_impl.go index 4b41304f46504..3f0fb102ba41a 100644 --- a/sensor/admission-control/manager/manager_impl.go +++ b/sensor/admission-control/manager/manager_impl.go @@ -329,6 +329,7 @@ func (m *manager) ProcessNewSettings(newSettings *sensor.AdmissionControlSetting m.cacheVersion = newSettings.GetCacheVersion() } + //#nosec G103 atomic.StorePointer(&m.statePtr, unsafe.Pointer(newState)) if m.lastSettingsUpdate == nil { log.Info("RE-ENABLING admission control service")