Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

gosec #741

Open
wants to merge 11 commits into
base: master
Choose a base branch
from
Open

gosec #741

wants to merge 11 commits into from

Conversation

yuvalk
Copy link
Member

@yuvalk yuvalk commented Sep 28, 2021

  • add gosec to verify target
  • fix CWE-22
  • fix all CWE-118 issues
  • fix CWE-276
  • fix CWE-703
  • ignore unchecked os.Unsetenv from gosec reports
  • fix CWE-703
  • ignore G204 in latency_testing

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 28, 2021

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: yuvalk
To complete the pull request process, please assign schseba after the PR has been reviewed.
You can assign the PR to them by writing /assign @schseba in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coveralls
Copy link

coveralls commented Sep 28, 2021 •
edited
Loading

Pull Request Test Coverage Report for Build 2050

  • 12 of 16 (75.0%) changed or added relevant lines in 5 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage decreased (-0.1%) to 61.256%
Changes Missing Coverage Covered Lines Changed/Added Lines %
pkg/profilecreator/profilecreator.go 5 9 55.56%
Totals Coverage Status
Change from base Build 2039: -0.1%
Covered Lines: 1570
Relevant Lines: 2563
💛 - Coveralls

@cynepco3hahue
Copy link
Contributor

Probably we need to set GOARCH and compiler variables under our CI.

Golang errors in file: [functests/utils/images]:
  > [line 0 : column 0] - loading files from package "functests/utils/images": could not determine GOARCH and Go compiler

@openshift-ci openshift-ci bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 1, 2021
@openshift-ci openshift-ci bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 4, 2021
@yuvalk yuvalk force-pushed the gosec branch 5 times, most recently from 33b1401 to 30e0948 Compare October 4, 2021 09:54
yuvalk
yuvalk commented Oct 4, 2021
View reviewed changes
hack/gosec.sh Outdated
go get -u github.com/securego/gosec/v2/cmd/gosec
fi

time GO111MODULE=off gosec -conf gosec.conf.json ./...
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added this GO111MODULE to make it work under prow
but I dont know WHY it work (without it, we're seeing could not determine GOARCH and Go compiler error )
if anyone can explain...
@fromanirh @cynepco3hahue maybe?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so with the GO111MODULE=on it works in the context of go modules and GO111MODULE=off in the context of GOPATH, so I am assuming something is configured on the PATH level that not configured on the module level(probably because of the CI)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you try to run
time GOARCH=<> GOOS=<> gosec -conf gosec.conf.json ./...?

yuvalk
yuvalk commented Oct 4, 2021
View reviewed changes
functests/utils/utils.go
@@ -36,7 +36,7 @@ func ExecAndLogCommandWithStderr(name string, arg ...string) ([]byte, []byte, er

var stdout bytes.Buffer
var stderr bytes.Buffer
cmd := exec.CommandContext(ctx, name, arg...)
cmd := exec.CommandContext(ctx, name, arg...) // #nosec G204
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@fromanirh I'm not actually sure this is a good,
do you have any idea how to make this from a closed list?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hardly. The whole purpose of this API is to run arbitrary commands on arbitrary nodes. Having and maintaining a allow list would be quite a big burden. So yes, the main defense here is carefully review HOW we use this API.

@openshift-ci openshift-ci bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 30, 2021
@yuvalk
add gosec to verify target
ec0e56c 
this will ensure code is always secured and does not include security
vunerabilities.
this will be verified by running gosec on all our sources

added placeholder for future gosec configs in gosec.conf.json
@yuvalk
fix CWE-22
ed45e68 
applying filepath.Clean, will make sure filename is not abused
@yuvalk
fix all CWE-118 issues
89412e3 
removed all refernces to loop iterator variable
@yuvalk
fix CWE-276
5e53083 
reducing permissions to 600
@yuvalk
fix CWE-703
44fc82b 
explicitly close the file and handle errors.

Close is considered unsafe to defer, because it might fail
@yuvalk
ignore unchecked os.Unsetenv from gosec reports
23ee18a 
it seems that, yes, we dont check for errors, but the function always
return nil err.

this is to avoid CWE-703 on os.Unsetenv
@yuvalk
fix CWE-703
bada12a 
Handle all error cases.

for the future, if error is very rare and unlikely to happen on any
normal (supported) user case, it's ok to use `panic(err)`
in other cases, it's better to propageate error up back to user and logs
@yuvalk
ignore G204 in latency_testing
6159efa 
This is ignored temporarily as gosec resolver doesnt properly support
Call Expressions
https://github.com/securego/gosec/blob/master/resolve.go#L70
@yuvalk
ignore G204 in ExecAndLogCommandWithStderr
3f7b7fa 
Ignored as general purpose command execution function
@yuvalk
WIP - test gosec with GO111MODULE=off
2df0ea1
@yuvalk
WIP: go get is deprecated..
45900be
@openshift-ci openshift-ci bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 11, 2021
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 11, 2021

@yuvalk: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/ci-index 45900be link true /test ci-index
ci/prow/ci 45900be link true /test ci
ci/prow/images 45900be link true /test images
ci/prow/e2e-gcp-operator-upgrade 45900be link true /test e2e-gcp-operator-upgrade
ci/prow/e2e-gcp 45900be link true /test e2e-gcp

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Feb 3, 2022

@yuvalk: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 3, 2022
@yanirq
Copy link
Member

yanirq commented Apr 13, 2022

@yuvalk please close this PR and open a new one on the NTO repo if needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ffromani ffromani ffromani left review comments

@cynepco3hahue cynepco3hahue Awaiting requested review from cynepco3hahue

@yanirq yanirq Awaiting requested review from yanirq

Assignees
No one assigned
Labels
needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@yuvalk @coveralls @cynepco3hahue @yanirq @ffromani