0

我正在尝试gosec在golangci-lint。但是，通过 golangci-lint 使用 gosec 时，不会报告 gosec 中报告的一些问题。

我使用了 https://github.com/golang/example项目。运行 goses 时报告了 3 个问题。

$ gosec gotypes
[gosec] 2020/11/12 13:56:09 Including rules: default
[gosec] 2020/11/12 13:56:09 Excluding rules: default
[gosec] 2020/11/12 13:56:09 Import directory: personal/sec-test-go/example/gotypes
[gosec] 2020/11/12 13:56:09 Checking package: main
[gosec] 2020/11/12 13:56:09 Checking file: personal/sec-test-go/example/gotypes/weave.go
Results:
[personal/sec-test-go/example/gotypes/weave.go:106] - G304 (CWE-22): Potential file inclusion via variable (Confidence: HIGH, Severity: MEDIUM)
    105: func include(file, tag string) (string, error) {
  > 106:    f, err := os.Open(file)
    107:    if err != nil {
[personal/sec-test-go/example/gotypes/weave.go:110] - G307 (CWE-703): Deferring unsafe method "Close" on type "*os.File" (Confidence: HIGH, Severity: MEDIUM)
    109:    }
  > 110:    defer f.Close()
    111:
[personal/sec-test-go/example/gotypes/weave.go:30] - G307 (CWE-703): Deferring unsafe method "Close" on type "*os.File" (Confidence: HIGH, Severity: MEDIUM)
    29:     }
  > 30:     defer f.Close()
    31:
Summary:
   Files: 1
   Lines: 191
   Nosec: 0
  Issues: 3

但是，当我使用 golangci-lint 运行与 gosec 相同的代码时，没有记录任何问题。

但是当我为另一组代码（示例代码中的另一个目录）运行这两个工具时，所有问题都被记录下来。

$ golangci-lint run outyet --disable-all -E gosec
outyet/main.go:98:12: G107: Potential HTTP request made with variable url (gosec)
    r, err := http.Head(url)

$ gosec outyet
[gosec] 2020/11/12 14:07:56 Including rules: default
[gosec] 2020/11/12 14:07:56 Excluding rules: default
[gosec] 2020/11/12 14:07:56 Import directory: personal/sec-test-go/example/outyet
[gosec] 2020/11/12 14:07:56 Checking package: main
[gosec] 2020/11/12 14:07:56 Checking file: sec-test-go/example/outyet/main.go
Results:

[personal/sec-test-go/example/outyet/main.go:98] - G107 (CWE-88): Potential HTTP request made with variable url (Confidence: MEDIUM, Severity: MEDIUM)
    97:     pollCount.Add(1)
  > 98:     r, err := http.Head(url)
    99:     if err != nil {

Summary:
   Files: 1
   Lines: 140
   Nosec: 0
  Issues: 1

有人遇到过这个问题吗？

4

1 回答 1

1

Golangci-lint 具有默认设置以减少误报的数量。

试试 --exclude-use-default=false 参数。

golangci-lint run outyet --disable-all --exclude-use-default=false -E gosec
于 2021-01-05T14:19:47.757 回答