string-to-int-signedness-cast.yaml

rules:
- id: string-to-int-signedness-cast
  message: Downcasting or changing sign of an integer with `$CAST_METHOD` method
  languages: [go]
  severity: WARNING
  metadata:
    category: security
    cwe: "CWE-681: Incorrect Conversion between Numeric Types"
    subcategory: [audit]
    confidence: HIGH
    likelihood: LOW
    impact: MEDIUM
    technology: [--no-technology--]
    description: "Integer underflows"
    references:
      - https://github.com/golang/go/issues/30209

  pattern-either:
    # 64 -> lower or sign
    - patterns:
      - metavariable-pattern:
          metavariable: $CAST_METHOD
          pattern-either:
            - pattern: uint8
            - pattern: uint16
            - pattern: uint32
            - pattern: int8
            - pattern: int16
            - pattern: int32

      - pattern-either:
        - pattern: |
            $X, ... = strconv.Atoi(...)
            ...
            $CAST_METHOD($X)

        - pattern: |
            $X, ... = strconv.ParseInt(..., ..., 64)
            ...
            $CAST_METHOD($X)

        - pattern: |
            $X, ... = strconv.ParseUint(..., ..., 64)
            ...
            $CAST_METHOD($X)

    # assume int has 64 bits
    - pattern: |
        $X, ... = strconv.Atoi(...)
        ...
        uint64($X)

    - pattern: |
        $X, ... = strconv.ParseInt(..., ..., 64)
        ...
        uint64($X)

    - pattern: |
        $X, ... = strconv.ParseUint(..., ..., 64)
        ...
        int64($X)

    # 32 -> lower or sign
    - patterns:
      - metavariable-pattern:
          metavariable: $CAST_METHOD
          pattern-either:
            - pattern: uint8
            - pattern: uint16
            - pattern: int8
            - pattern: int16

      - pattern-either:
        - pattern: |
            $X, ... = strconv.ParseInt(..., ..., 32)
            ...
            $CAST_METHOD($X)

        - pattern: |
            $X, ... = strconv.ParseUint(..., ..., 32)
            ...
            $CAST_METHOD($X)

    - pattern: |
        $X, ... = strconv.ParseInt(..., ..., 32)
        ...
        uint32($X)

    - pattern: |
        $X, ... = strconv.ParseUint(..., ..., 32)
        ...
        int32($X)

    # 16 -> lower or sign
    - patterns:
      - metavariable-pattern:
          metavariable: $CAST_METHOD
          pattern-either:
            - pattern: uint8
            - pattern: int8

      - pattern-either:
        - pattern: |
            $X, ... = strconv.ParseInt(..., ..., 16)
            ...
            $CAST_METHOD($X)

        - pattern: |
            $X, ... = strconv.ParseUint(..., ..., 16)
            ...
            $CAST_METHOD($X)

    - pattern: |
        $X, ... = strconv.ParseInt(..., ..., 16)
        ...
        uint16($X)

    - pattern: |
        $X, ... = strconv.ParseUint(..., ..., 16)
        ...
        int16($X)


    # 8 -> sign
    - pattern: |
        $X, ... = strconv.ParseInt(..., ..., 8)
        ...
        uint8($X)

    - pattern: |
        $X, ... = strconv.ParseUint(..., ..., 8)
        ...
        int8($X)