66 lines
1.8 KiB
Go
66 lines
1.8 KiB
Go
|
package sa1005
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"go/ast"
|
|||
|
|
"strings"
|
|||
|
|
|
|||
|
|
"honnef.co/go/tools/analysis/code"
|
|||
|
|
"honnef.co/go/tools/analysis/lint"
|
|||
|
|
"honnef.co/go/tools/analysis/report"
|
|||
|
|
"honnef.co/go/tools/pattern"
|
|||
|
|
|
|||
|
|
"golang.org/x/tools/go/analysis"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
var SCAnalyzer = lint.InitializeAnalyzer(&lint.Analyzer{
|
|||
|
|
Analyzer: &analysis.Analyzer{
|
|||
|
|
Name: "SA1005",
|
|||
|
|
Run: run,
|
|||
|
|
Requires: code.RequiredAnalyzers,
|
|||
|
|
},
|
|||
|
|
Doc: &lint.RawDocumentation{
|
|||
|
|
Title: `Invalid first argument to \'exec.Command\'`,
|
|||
|
|
Text: `\'os/exec\' runs programs directly (using variants of the fork and exec
|
|||
|
|
system calls on Unix systems). This shouldn't be confused with running
|
|||
|
|
a command in a shell. The shell will allow for features such as input
|
|||
|
|
redirection, pipes, and general scripting. The shell is also
|
|||
|
|
responsible for splitting the user's input into a program name and its
|
|||
|
|
arguments. For example, the equivalent to
|
|||
|
|
|
|||
|
|
ls / /tmp
|
|||
|
|
|
|||
|
|
would be
|
|||
|
|
|
|||
|
|
exec.Command("ls", "/", "/tmp")
|
|||
|
|
|
|||
|
|
If you want to run a command in a shell, consider using something like
|
|||
|
|
the following – but be aware that not all systems, particularly
|
|||
|
|
Windows, will have a \'/bin/sh\' program:
|
|||
|
|
|
|||
|
|
exec.Command("/bin/sh", "-c", "ls | grep Awesome")`,
|
|||
|
|
Since: "2017.1",
|
|||
|
|
Severity: lint.SeverityWarning,
|
|||
|
|
MergeIf: lint.MergeIfAny,
|
|||
|
|
},
|
|||
|
|
})
|
|||
|
|
|
|||
|
|
var Analyzer = SCAnalyzer.Analyzer
|
|||
|
|
|
|||
|
|
var query = pattern.MustParse(`(CallExpr (Symbol "os/exec.Command") arg1:_)`)
|
|||
|
|
|
|||
|
|
func run(pass *analysis.Pass) (any, error) {
|
|||
|
|
for _, m := range code.Matches(pass, query) {
|
|||
|
|
arg1 := m.State["arg1"].(ast.Expr)
|
|||
|
|
val, ok := code.ExprToString(pass, arg1)
|
|||
|
|
if !ok {
|
|||
|
|
continue
|
|||
|
|
}
|
|||
|
|
if !strings.Contains(val, " ") || strings.Contains(val, `\`) || strings.Contains(val, "/") {
|
|||
|
|
continue
|
|||
|
|
}
|
|||
|
|
report.Report(pass, arg1,
|
|||
|
|
"first argument to exec.Command looks like a shell command, but a program name or path are expected")
|
|||
|
|
}
|
|||
|
|
return nil, nil
|
|||
|
|
}
|