Skip to content

Commit d09b682

Browse files
TekWizelyTekWizely
committed
Added gosec support (as 'go-sec-*')
1 parent f167a2e commit d09b682

7 files changed

+266
-4
lines changed

‎.pre-commit-hooks.yaml

+66
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,72 @@
140140
description: "Run 'goreturns -l -d [$ARGS] $FILE' for each staged .go file"
141141
pass_filenames: true
142142

143+
# ==============================================================================
144+
# go-sec-mod
145+
# * Folder-Based
146+
# * Recursive
147+
# * Targets first parent folder with a go.mod file
148+
# * Executes if any .go files modified
149+
# * Executes if go.mod modified
150+
# ==============================================================================
151+
- id: go-sec-mod
152+
name: 'go-sec-mod'
153+
entry: go-sec-mod.sh
154+
files: '(\.go$)|(\bgo\.mod$)'
155+
exclude: '(^|/)vendor/'
156+
language: 'script'
157+
description: "Run 'cd $(mod_root $FILE); gosec [$ARGS] ./...' for each staged .go file"
158+
pass_filenames: true
159+
require_serial: true
160+
161+
# ==============================================================================
162+
# go-sec-pkg
163+
# * Folder-Based
164+
# * Targets folder containing staged file
165+
# * Executes if any .go files modified
166+
# ==============================================================================
167+
- id: go-sec-pkg
168+
name: 'go-sec-pkg'
169+
entry: go-sec-pkg.sh
170+
types: [go]
171+
exclude: '(^|/)vendor/'
172+
language: 'script'
173+
description: "Run 'gosec [$ARGS] ./$(dirname $FILE)' for each staged .go file"
174+
pass_filenames: true
175+
require_serial: true
176+
177+
# ==============================================================================
178+
# go-sec-repo-mod
179+
# * Repo-Based
180+
# * Recursive
181+
# * Targets ALL folders with a go.mod file
182+
# * Executes if any .go files modified
183+
# * Executes if go.mod modified
184+
# ==============================================================================
185+
- id: go-sec-repo-mod
186+
name: 'go-sec-repo-mod'
187+
entry: go-sec-repo-mod.sh
188+
files: '(\.go$)|(\bgo\.mod$)'
189+
exclude: '(^|/)vendor/'
190+
language: 'script'
191+
description: "Run 'cd $(mod_root); gosec [$ARGS] ./...' for each module in the repo"
192+
pass_filenames: false
193+
194+
# ==============================================================================
195+
# go-sec-repo-pkg
196+
# * Repo-Based
197+
# * Recursive
198+
# * Executes if any .go files modified
199+
# ==============================================================================
200+
- id: go-sec-repo-pkg
201+
name: 'go-sec-repo-pkg'
202+
entry: go-sec-repo-pkg.sh
203+
types: [go]
204+
exclude: '(^|/)vendor/'
205+
language: 'script'
206+
description: "Run 'gosec [$ARGS] ./...' in repo root folder"
207+
pass_filenames: false
208+
143209
# ==============================================================================
144210
# go-test-mod
145211
# * Folder-Based

‎README.md

+32-4
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,13 @@ You can copy/paste the following snippet into your `.pre-commit-config.yaml` fil
5454
- id: go-vet-repo-mod
5555
- id: go-vet-repo-pkg
5656
#
57+
# GoSec
58+
#
59+
- id: go-sec-mod
60+
- id: go-sec-pkg
61+
- id: go-sec-repo-mod
62+
- id: go-sec-repo-pkg
63+
#
5764
# Formatters
5865
#
5966
- id: go-fmt
@@ -160,6 +167,7 @@ Consider adding aliases to longer-named hooks for easier CLI usage.
160167
- [go-build](#go-build)
161168
- [go-test](#go-test)
162169
- [go-vet](#go-vet)
170+
- [go-sec](#go-sec)
163171
- Formatters
164172
- [go-fmt](#go-fmt)
165173
- [go-imports](#go-imports)
@@ -194,10 +202,10 @@ Automates testing, printing a summary of test resutls.
194202
195203
| Hook ID | Description
196204
|--------------------|------------
197-
| `go-test-mod` | Run `'cd $(mod_root $FILE); go test [$ARGS] ./...'` for each staged .go file
198-
| `go-test-pkg` | Run `'go test [$ARGS] ./$(dirname $FILE)'` for each staged .go file
199-
| `go-test-repo-mod` | Run `'cd $(mod_root); go test [$ARGS] ./...'` for each module in the repo
200-
| `go-test-repo-pkg` | Run `'go test [$ARGS] ./...'` in repo root folder
205+
| `go-test-mod` | Run `'cd $(mod_root $FILE); gosec [$ARGS] ./...'` for each staged .go file
206+
| `go-test-pkg` | Run `'gosec [$ARGS] ./$(dirname $FILE)'` for each staged .go file
207+
| `go-test-repo-mod` | Run `'cd $(mod_root); gosec [$ARGS] ./...'` for each module in the repo
208+
| `go-test-repo-pkg` | Run `'gosec [$ARGS] ./...'` in repo root folder
201209
202210
##### Install
203211
Comes with Golang ( [golang.org](https://golang.org/) )
@@ -206,6 +214,26 @@ Comes with Golang ( [golang.org](https://golang.org/) )
206214
- https://golang.org/cmd/go/#hdr-Test_packages
207215
- `go help test`
208216
217+
-----------
218+
### go-sec
219+
Inspects source code for security problems by scanning the Go AST.
220+
221+
| Hook ID | Description
222+
|-------------------|------------
223+
| `go-sec-mod` | Run `'cd $(mod_root $FILE); gosec [$ARGS] ./...'` for each staged .go file
224+
| `go-sec-pkg` | Run `'gosec [$ARGS] ./$(dirname $FILE)'` for each staged .go file
225+
| `go-sec-repo-mod` | Run `'cd $(mod_root); gosec [$ARGS] ./...'` for each module in the repo
226+
| `go-sec-repo-pkg` | Run `'gosec [$ARGS] ./...'` in repo root folder
227+
228+
##### Install
229+
```
230+
go get github.com/securego/gosec/v2/cmd/gosec
231+
```
232+
233+
##### Help
234+
- https://github.com/securego/gosec#usage
235+
- `gosec (no args)`
236+
209237
----------
210238
### go-vet
211239
Examines Go source code and reports suspicious constructs, such as

‎go-sec-mod.sh

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
#!/usr/bin/env bash
2+
3+
cmd=(gosec)
4+
5+
export GO111MODULE=on
6+
7+
# Walks up the file path looking for go.mod
8+
#
9+
function find_module_roots() {
10+
for arg in "$@" ; do
11+
local path="${arg}"
12+
if [ "${path}" == "" ]; then
13+
path="."
14+
elif [ -f "${path}" ]; then
15+
path=$(dirname "${path}")
16+
fi
17+
while [ "${path}" != "." ] && [ ! -f "${path}/go.mod" ]; do
18+
path=$(dirname "${path}")
19+
done
20+
if [ -f "${path}/go.mod" ]; then
21+
echo "${path}"
22+
fi
23+
done
24+
}
25+
26+
OPTIONS=()
27+
# If arg doesn't pass [ -f ] check, then it is assumed to be an option
28+
#
29+
while [ $# -gt 0 ] && [ "$1" != "-" ] && [ "$1" != "--" ] && [ ! -f "$1" ]; do
30+
OPTIONS+=("$1")
31+
shift
32+
done
33+
34+
FILES=()
35+
# Assume start of file list (may still be options)
36+
#
37+
while [ $# -gt 0 ] && [ "$1" != "-" ] && [ "$1" != "--" ]; do
38+
FILES+=("$1")
39+
shift
40+
done
41+
42+
# If '--' next, then files = options
43+
#
44+
if [ $# -gt 0 ]; then
45+
if [ "$1" == "-" ] || [ "$1" == "--" ]; then
46+
shift
47+
# Append to previous options
48+
#
49+
OPTIONS=("${OPTIONS[@]}" "${FILES[@]}")
50+
FILES=()
51+
fi
52+
fi
53+
54+
# Any remaining arguments are assumed to be files
55+
#
56+
while [ $# -gt 0 ]; do
57+
FILES+=("$1")
58+
shift
59+
done
60+
61+
errCode=0
62+
for sub in $(find_module_roots "${FILES[@]}" | sort -u) ; do
63+
pushd "${sub}" >/dev/null
64+
"${cmd[@]}" "${OPTIONS[@]}" ./...
65+
if [ $? -ne 0 ]; then
66+
errCode=1
67+
fi
68+
popd >/dev/null
69+
done
70+
exit $errCode

‎go-sec-pkg.sh

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#!/usr/bin/env bash
2+
3+
cmd=(gosec)
4+
5+
export GO111MODULE=off
6+
7+
OPTIONS=()
8+
# If arg doesn't pass [ -f ] check, then it is assumed to be an option
9+
#
10+
while [ $# -gt 0 ] && [ "$1" != "-" ] && [ "$1" != "--" ] && [ ! -f "$1" ]; do
11+
OPTIONS+=("$1")
12+
shift
13+
done
14+
15+
FILES=()
16+
# Assume start of file list (may still be options)
17+
#
18+
while [ $# -gt 0 ] && [ "$1" != "-" ] && [ "$1" != "--" ]; do
19+
FILES+=("$1")
20+
shift
21+
done
22+
23+
# If '--' next, then files = options
24+
#
25+
if [ $# -gt 0 ]; then
26+
if [ "$1" == "-" ] || [ "$1" == "--" ]; then
27+
shift
28+
# Append to previous options
29+
#
30+
OPTIONS=("${OPTIONS[@]}" "${FILES[@]}")
31+
FILES=()
32+
fi
33+
fi
34+
35+
# Any remaining arguments are assumed to be files
36+
#
37+
while [ $# -gt 0 ]; do
38+
FILES+=("$1")
39+
shift
40+
done
41+
42+
errCode=0
43+
for sub in $(echo "${FILES[@]}" | xargs -n1 dirname | sort -u); do
44+
"${cmd[@]}" "${OPTIONS[@]}" "./${sub}"
45+
if [ $? -ne 0 ]; then
46+
errCode=1
47+
fi
48+
done
49+
exit $errCode

‎go-sec-repo-mod.sh

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/usr/bin/env bash
2+
3+
cmd=(gosec)
4+
5+
export GO111MODULE=on
6+
7+
OPTIONS=()
8+
# Build options list, ignoring '-', '--', and anything after
9+
#
10+
while [ $# -gt 0 ] && [ "$1" != "-" ] && [ "$1" != "--" ]; do
11+
OPTIONS+=("$1")
12+
shift
13+
done
14+
15+
errCode=0
16+
# Assume parent folder of go.mod is module root folder
17+
#
18+
for sub in $(find . -name go.mod -not -path '*/vendor/*' | xargs -n1 dirname | sort -u) ; do
19+
pushd "${sub}" >/dev/null
20+
"${cmd[@]}" "${OPTIONS[@]}" ./...
21+
if [ $? -ne 0 ]; then
22+
errCode=1
23+
fi
24+
popd >/dev/null
25+
done
26+
exit $errCode

‎go-sec-repo-pkg.sh

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env bash
2+
set -e
3+
4+
cmd=(gosec)
5+
6+
export GO111MODULE=off
7+
8+
OPTIONS=()
9+
# Build options list, ignoring '-', '--', and anything after
10+
#
11+
while [ $# -gt 0 ] && [ "$1" != "-" ] && [ "$1" != "--" ]; do
12+
OPTIONS+=("$1")
13+
shift
14+
done
15+
16+
"${cmd[@]}" "${OPTIONS[@]}" ./...

‎sample-config.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,13 @@ repos:
9797
- id: go-vet-repo-mod
9898
- id: go-vet-repo-pkg
9999
#
100+
# GoSec
101+
#
102+
- id: go-sec-mod
103+
- id: go-sec-pkg
104+
- id: go-sec-repo-mod
105+
- id: go-sec-repo-pkg
106+
#
100107
# Formatters
101108
#
102109
- id: go-fmt

0 commit comments

Comments
 (0)