Skip to content

Commit dc1e25d

Browse files
allmightyspiffGitHub Enterprise
allmightyspiff
authored and
GitHub Enterprise
committed
Merge pull request #867 from SoftLayer/gosec
Fixing Gosec complaints
2 parents d2df65c + 687712a commit dc1e25d

15 files changed

Lines changed: 266 additions & 226 deletions

File tree

‎.secrets.baseline‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "plugin/i18n/v1Resources/|plugin/i18n/v2Resources/|(.*test.*)|(vendor)|(go.sum)|bin/|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2024-07-22T22:42:28Z",
6+
"generated_at": "2024-09-04T21:46:16Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"
@@ -270,23 +270,23 @@
270270
"hashed_secret": "df4bb9b1035a1847159d5c655c1d11a00508a609",
271271
"is_secret": false,
272272
"is_verified": false,
273-
"line_number": 93,
273+
"line_number": 89,
274274
"type": "Secret Keyword",
275275
"verified_result": null
276276
},
277277
{
278-
"hashed_secret": "53aa77492eb716085c45d2c5873f9e47abd66bf2",
278+
"hashed_secret": "09d3c49efe52ba11e94d7bdd18d2801a7830f583",
279279
"is_secret": false,
280280
"is_verified": false,
281-
"line_number": 95,
281+
"line_number": 91,
282282
"type": "Secret Keyword",
283283
"verified_result": null
284284
},
285285
{
286286
"hashed_secret": "18a6fefdd2d6204456b0733cc47be1397f284fa4",
287287
"is_secret": false,
288288
"is_verified": false,
289-
"line_number": 98,
289+
"line_number": 94,
290290
"type": "Secret Keyword",
291291
"verified_result": null
292292
}

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ require (
3434
github.com/pmezard/go-difflib v1.0.0 // indirect
3535
github.com/rivo/uniseg v0.4.7 // indirect
3636
github.com/rogpeppe/go-internal v1.9.0 // indirect
37+
github.com/sethvargo/go-password v0.3.1 // indirect
3738
github.com/softlayer/xmlrpc v0.0.0-20200409220501-5f089df7cb7e // indirect
3839
golang.org/x/crypto v0.24.0 // indirect
3940
golang.org/x/mod v0.18.0 // indirect

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@ github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/f
6666
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
6767
github.com/sclevine/spec v1.4.0 h1:z/Q9idDcay5m5irkZ28M7PtQM4aOISzOpj4bUPkDee8=
6868
github.com/sclevine/spec v1.4.0/go.mod h1:LvpgJaFyvQzRvc1kaDs0bulYwzC70PbiYjC4QnFHkOM=
69+
github.com/sethvargo/go-password v0.3.1 h1:WqrLTjo7X6AcVYfC6R7GtSyuUQR9hGyAj/f1PYQZCJU=
70+
github.com/sethvargo/go-password v0.3.1/go.mod h1:rXofC1zT54N7R8K/h1WDUdkf9BOx5OptoxrMBcrXzvs=
6971
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
7072
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
7173
github.com/smartystreets/goconvey v1.6.7 h1:I6tZjLXD2Q1kjvNbIzB1wvQBsXmKXiVrhpRE8ZjP5jY=

‎plugin/commands/block/volume_detail.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ func (cmd *VolumeDetailCommand) Run(args []string) error {
102102
}
103103

104104
table.Add(T("Replicant Count"), utils.FormatUIntPointer(blockVolume.ReplicationPartnerCount))
105+
// #nosec G115 -- Should never be > 2^32
105106
if blockVolume.ReplicationPartnerCount != nil && int(*blockVolume.ReplicationPartnerCount) > 0 {
106107
table.Add(T("Replication Status"), utils.FormatStringPointer(blockVolume.ReplicationStatus))
107108
buf := new(bytes.Buffer)

‎plugin/commands/file/volume_detail.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ func (cmd *VolumeDetailCommand) Run(args []string) error {
103103
}
104104

105105
table.Add(T("Replicant Count"), utils.FormatUIntPointer(fileVolume.ReplicationPartnerCount))
106+
// #nosec G115 -- Should never be > 2^32
106107
if fileVolume.ReplicationPartnerCount != nil && int(*fileVolume.ReplicationPartnerCount) > 0 {
107108
table.Add(T("Replication Status"), utils.FormatStringPointer(fileVolume.ReplicationStatus))
108109
buf := new(bytes.Buffer)

‎plugin/commands/ticket/summary.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
package ticket
22

33
import (
4-
"strconv"
54

5+
"fmt"
66
"github.com/spf13/cobra"
77

88
"github.ibm.com/SoftLayer/softlayer-cli/plugin/errors"
@@ -45,15 +45,15 @@ func (cmd *SummaryTicketCommand) Run(args []string) error {
4545
table := cmd.UI.Table([]string{T("Status:"), T("Count")})
4646

4747
table.Add(T("Open:"), "")
48-
table.Add(T("Accounting"), strconv.Itoa(int(summary.Accounting)))
49-
table.Add(T("Billing"), strconv.Itoa(int(summary.Billing)))
50-
table.Add(T("Sales"), strconv.Itoa(int(summary.Sales)))
51-
table.Add(T("Support"), strconv.Itoa(int(summary.Support)))
52-
table.Add(T("Other"), strconv.Itoa(int(summary.Other)))
53-
table.Add(T("Total"), strconv.Itoa(int(summary.Open)))
48+
table.Add(T("Accounting"), fmt.Sprintf("%d", summary.Accounting))
49+
table.Add(T("Billing"), fmt.Sprintf("%d", summary.Billing))
50+
table.Add(T("Sales"), fmt.Sprintf("%d", summary.Sales))
51+
table.Add(T("Support"), fmt.Sprintf("%d", summary.Support))
52+
table.Add(T("Other"), fmt.Sprintf("%d", summary.Other))
53+
table.Add(T("Total"), fmt.Sprintf("%d", summary.Open))
5454
table.Add("", "")
5555
table.Add(T("Closed:"), "")
56-
table.Add(T("Total"), strconv.Itoa(int(summary.Closed)))
56+
table.Add(T("Total"), fmt.Sprintf("%d", summary.Closed))
5757

5858
table.Print()
5959

‎plugin/commands/user/create.go‎

Lines changed: 4 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,11 @@
11
package user
22

33
import (
4-
crand "crypto/rand"
5-
"encoding/binary"
64
"encoding/json"
75
"fmt"
8-
"log"
9-
"math/rand"
106
"reflect"
11-
"strings"
127

8+
gopass "github.com/sethvargo/go-password/password"
139
"github.ibm.com/SoftLayer/softlayer-cli/plugin/metadata"
1410

1511
"github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/terminal"
@@ -92,7 +88,7 @@ func (cmd *CreateCommand) Run(args []string) error {
9288

9389
password := cmd.Password
9490
if password == "generate" {
95-
password = string(GeneratePassword(23, 4))
91+
password = gopass.MustGenerate(18, 4, 4, false, false)
9692
}
9793

9894
vpnPassword := cmd.VpnPassword
@@ -139,54 +135,9 @@ func printUser(user datatypes.User_Customer, password string, ui terminal.UI) {
139135
table.Print()
140136
}
141137

142-
// random source leveraging crypto/rand to provide
143-
// true non-determinstic
144-
type cryptoSource struct{}
145-
146-
func (s cryptoSource) Seed(seed int64) {}
147-
148-
func (s cryptoSource) Int63() int64 {
149-
return int64(s.Uint64() & ^uint64(1<<63))
150-
}
151-
152-
func (s cryptoSource) Uint64() (v uint64) {
153-
err := binary.Read(crand.Reader, binary.BigEndian, &v)
154-
if err != nil {
155-
log.Fatal(err)
156-
}
157-
return v
158-
}
159-
160-
// GeneratePassword will create a random password
161-
// Returns a 23 character random string
162-
// 0 only number
163-
// 1 lower and upper
164-
// 2 upper
165-
// 3 special
166-
// 4 all
167-
func GeneratePassword(size int, kind int) []byte {
168-
ikind, kinds, result := kind, [][]int{{10, 48}, {26, 97}, {26, 65}, {10, 38}}, make([]byte, size)
169-
isAll := kind > 3 || kind < 0
170-
171-
// #nosec G404: Use "crypto/rand" as the seed, which should resolve the pseudo "math/rand"
172-
rnd := rand.New(&cryptoSource{})
173-
generate := true
174-
for generate {
175-
result = make([]byte, size)
176-
for i := 0; i < size; i++ {
177-
if isAll { // random ikind
178-
ikind = rnd.Intn(4)
179-
}
180-
scope, base := kinds[ikind][0], kinds[ikind][1]
181-
result[i] = uint8(base + rnd.Intn(scope))
182-
}
183-
generate = !IsValidPassword(string(result))
184-
}
185-
return result
186-
}
187-
138+
// Values of B get copied into A
139+
// A <--- B
188140
func StructAssignment(A, B interface{}) { //a =b
189-
190141
av := reflect.ValueOf(A).Elem()
191142
at := av.Type()
192143

@@ -202,34 +153,3 @@ func StructAssignment(A, B interface{}) { //a =b
202153
}
203154
}
204155
}
205-
206-
func IsValidPassword(output string) bool {
207-
output = strings.TrimSpace(output)
208-
var uppercase, lowercase, number, simbol, lenght bool
209-
//Verify lenght is 23
210-
if len(output) == 23 {
211-
lenght = true
212-
}
213-
for _, char := range output {
214-
//Verify exist uppercase
215-
if int(char) >= 65 && int(char) <= 90 {
216-
uppercase = true
217-
}
218-
//Verify exist lowercase
219-
if int(char) >= 97 && int(char) <= 122 {
220-
lowercase = true
221-
}
222-
//Verify exist number
223-
if int(char) >= 48 && int(char) <= 57 {
224-
number = true
225-
}
226-
//Verify exist simbol
227-
if int(char) >= 33 && int(char) <= 47 {
228-
simbol = true
229-
}
230-
}
231-
if uppercase && lowercase && number && simbol && lenght {
232-
return true
233-
}
234-
return false
235-
}

0 commit comments

Comments
 (0)