Modify rule S2092: Add Go language (#2760)

This commit is contained in:
Sebastien Andrivet 2025-01-28 11:16:42 +01:00 committed by GitHub
parent 35c4205143
commit 2b798c3265
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 159 additions and 0 deletions

View File

@ -0,0 +1,3 @@
{
"quickfix": "unknown"
}

156
rules/S2092/go/rule.adoc Normal file
View File

@ -0,0 +1,156 @@
include::../description.adoc[]
include::../ask-yourself.adoc[]
include::../recommended.adoc[]
== Sensitive Code Example
For https://pkg.go.dev/std[Go Standard Library]:
[source,go,diff-id=1,diff-type=noncompliant]
----
import "net/http"
func handler(w http.ResponseWriter, req *http.Request) {
cookie := http.Cookie{}
cookie.Name = "cookiename"
cookie.Value = "cookievalue"
http.SetCookie(w, &cookie) // Sensitive: Secure is false by default
}
----
For https://pkg.go.dev/github.com/beego/beego/v2/server/web[Beego]:
[source,go,diff-id=2,diff-type=noncompliant]
----
import "github.com/beego/beego/v2/server/web"
func (ctrl *MainController) handler() {
ctrl.Ctx.SetCookie("name1", "value1", 200, "/", "example.com", false, false) // Sensitive
}
----
For https://pkg.go.dev/github.com/gofiber/fiber/v2[Fiber]:
[source,go,diff-id=3,diff-type=noncompliant]
----
import "github.com/gofiber/fiber/v2"
func handler(c *fiber.Ctx) error {
cookie := new(fiber.Cookie)
cookie.Name = "name"
cookie.Value = "value"
c.Cookie(cookie) // Sensitive: Secure is false by default
return c.SendString("")
}
----
For https://pkg.go.dev/github.com/gin-gonic/gin[Gin]:
[source,go,diff-id=4,diff-type=noncompliant]
----
import "github.com/gin-gonic/gin"
func handler(c *gin.Context) {
c.SetCookie("name", "value", 200, "/", "example.com", false, false) // Sensitive
c.JSON(http.StatusOK, gin.H{"message": ""})
}
----
== Compliant Solution
For https://pkg.go.dev/std[Go Standard Library]:
[source,go,diff-id=1,diff-type=compliant]
----
import "net/http"
func handler(w http.ResponseWriter, req *http.Request) {
cookie := http.Cookie{}
cookie.Name = "cookiename"
cookie.Value = "cookievalue"
cookie.Secure = true
http.SetCookie(w, &cookie)
}
----
For https://pkg.go.dev/github.com/beego/beego/v2/server/web[Beego]:
[source,go,diff-id=2,diff-type=compliant]
----
import "github.com/beego/beego/v2/server/web"
func (ctrl *MainController) handler() {
ctrl.Ctx.SetCookie("name1", "value1", 200, "/", "example.com", true, false)
}
----
For https://pkg.go.dev/github.com/gofiber/fiber/v2[Fiber]:
[source,go,diff-id=3,diff-type=compliant]
----
import "github.com/gofiber/fiber/v2"
func handler(c *fiber.Ctx) error {
cookie := new(fiber.Cookie)
cookie.Name = "name"
cookie.Value = "value"
cookie.Secure = true
c.Cookie(cookie)
return c.SendString("")
}
----
For https://pkg.go.dev/github.com/gin-gonic/gin[Gin]:
[source,go,diff-id=4,diff-type=compliant]
----
import "github.com/gin-gonic/gin"
func handler(c *gin.Context) {
c.SetCookie("name", "value", 200, "/", "example.com", true, false)
c.JSON(http.StatusOK, gin.H{"message": ""})
}
----
include::../see.adoc[]
ifdef::env-github,rspecator-view[]
'''
== Implementation Specification
(visible only on this page)
include::../message.adoc[]
=== Highlighting
For Go Standard Library:
* Highlight `SetCookie` if it is assigned an `http.Cookie` that has not `Secure` field specified.
* Highlight `Secure` field of `http.Cookie` if it is set to `false`.
For Beego:
* Highlight the 6th argument of `web.Controller.Context.SetCookie` if it is set to `false`.
* Highlight the 6th argument of `web.Controller.Context.Output.Cookie` if it is set to `false`.
* Highlight the 6th argument of `web.Controller.Context.SetSecureCookie` if it is set to `false`.
For Fiber:
* Highlight `Cookie` if it is assigned a `fiber.Cookie` that has not `Secure` field specified.
* Highlight `Secure` field of `fiber.Cookie` if it is set to `false`.
For Gin:
* Highlight the 6th argument of `gin.Context.SetCookie` if it is set to `false`.
'''
== Comments And Links
(visible only on this page)
include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]