nccgroup / sobelow

Security-focused static analysis for the Phoenix Framework
Apache License 2.0
1.66k stars 92 forks source link

no match of right hand side value 'config' #81

Closed davinerd closed 3 years ago

davinerd commented 3 years ago

Got the following while running sobelow 0.10.5 and 0.10.6 on https://github.com/fixthestatusquo/proca-backend

➜  proca-backend git:(main) mix sobelow
Checking Sobelow version...

##############################################
#                                            #
#          Running Sobelow - v0.10.6         #
#  Created by Griffin Byatt - @griffinbyatt  #
#     NCC Group - https://nccgroup.trust     #
#                                            #
##############################################

[...]

** (MatchError) no match of right hand side value: {:error, {[line: 33, column: 1], "syntax error before: ", "config"}}
    lib/sobelow/parse.ex:41: Sobelow.Parse.ast/1
    lib/sobelow/config.ex:127: Sobelow.Config.get_configs/2
    lib/sobelow/config/secrets.ex:26: anonymous fn/2 in Sobelow.Config.Secrets.run/2
    (elixir 1.11.2) lib/enum.ex:786: Enum."-each/2-lists^foreach/1-0-"/2
    lib/sobelow.ex:92: Sobelow.run/0
    (mix 1.11.2) lib/mix/task.ex:394: Mix.Task.run_task/3
    (mix 1.11.2) lib/mix/cli.ex:84: Mix.CLI.run_task/2
➜  proca-backend git:(main) 

As I'm getting my feet into Elixir and erlang in general, I'm not able to troubleshoot more than this. I've checked lib/sobelow/config.ex but didn't found anything suspicious.

GriffinMB commented 3 years ago

Hey! This error is related to a config file in proca-backend; it looks like there is a stray "," causing an error in compilation here: https://github.com/fixthestatusquo/proca-backend/blob/main/config/prod.secret.exs#L30

Removing that should solve the issue! I will also catch compilation errors since it's not very user friendly as-is.

GriffinMB commented 3 years ago

I just pushed a change to master, you can install with mix escript.install github nccgroup/sobelow to test it out! I'm pushing a release tomorrow, and will include this change.

Thanks for flagging :)

GriffinMB commented 3 years ago

This is in the latest release. Thanks again!