gosec 沖突導致 golangci-lint 工具

Question

我正在嘗試在golangci -lint中執行 gosec。 但是，通過 golangci-lint 使用 gosec 時，不會報告 gosec 中報告的一些問題。

我用過https://github.com/golang/example項目。 運行 gose 時報告了 3 個問題。

$ gosec gotypes
[gosec] 2020/11/12 13:56:09 Including rules: default
[gosec] 2020/11/12 13:56:09 Excluding rules: default
[gosec] 2020/11/12 13:56:09 Import directory: personal/sec-test-go/example/gotypes
[gosec] 2020/11/12 13:56:09 Checking package: main
[gosec] 2020/11/12 13:56:09 Checking file: personal/sec-test-go/example/gotypes/weave.go
Results:
[personal/sec-test-go/example/gotypes/weave.go:106] - G304 (CWE-22): Potential file inclusion via variable (Confidence: HIGH, Severity: MEDIUM)
    105: func include(file, tag string) (string, error) {
  > 106:    f, err := os.Open(file)
    107:    if err != nil {
[personal/sec-test-go/example/gotypes/weave.go:110] - G307 (CWE-703): Deferring unsafe method "Close" on type "*os.File" (Confidence: HIGH, Severity: MEDIUM)
    109:    }
  > 110:    defer f.Close()
    111:
[personal/sec-test-go/example/gotypes/weave.go:30] - G307 (CWE-703): Deferring unsafe method "Close" on type "*os.File" (Confidence: HIGH, Severity: MEDIUM)
    29:     }
  > 30:     defer f.Close()
    31:
Summary:
   Files: 1
   Lines: 191
   Nosec: 0
  Issues: 3

但是，當我使用 golangci-lint 通過 gosec 運行相同的代碼時，沒有記錄任何問題。

但是當我為另一組代碼（示例代碼中的另一個目錄）運行這兩個工具時，所有問題都被記錄下來了。

$ golangci-lint run outyet --disable-all -E gosec
outyet/main.go:98:12: G107: Potential HTTP request made with variable url (gosec)
    r, err := http.Head(url)

$ gosec outyet
[gosec] 2020/11/12 14:07:56 Including rules: default
[gosec] 2020/11/12 14:07:56 Excluding rules: default
[gosec] 2020/11/12 14:07:56 Import directory: personal/sec-test-go/example/outyet
[gosec] 2020/11/12 14:07:56 Checking package: main
[gosec] 2020/11/12 14:07:56 Checking file: sec-test-go/example/outyet/main.go
Results:

[personal/sec-test-go/example/outyet/main.go:98] - G107 (CWE-88): Potential HTTP request made with variable url (Confidence: MEDIUM, Severity: MEDIUM)
    97:     pollCount.Add(1)
  > 98:     r, err := http.Head(url)
    99:     if err != nil {

Summary:
   Files: 1
   Lines: 140
   Nosec: 0
  Issues: 1

有人遇到過這個問題嗎？

Answer 1

Golangci-lint 有默認設置來減少誤報的數量。

試試 --exclude-use-default=false 參數。

golangci-lint run outyet --disable-all --exclude-use-default=false -E gosec