search

securego / gosec

Go security checker
https://securego.io
Apache License 2.0
7.71k stars 606 forks source link

Fix conversion overflow false positives #1189

Closed czechbol closed 2 weeks ago

czechbol commented 2 weeks ago

This pull request hopefully fixes the issue of false positives in the overflow analysis whenever bounds checks are performed or the size is already pre-determined.

Disclaimer: This is my first time contributing to any linter and I don't consider myself being an AST wizard so please be more cautious when reviewing this code.

fixes #1187

codecov-commenter commented 2 weeks ago

:warning: Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

Attention: Patch coverage is 77.35849% with 12 lines in your changes missing coverage. Please review.

Project coverage is 67.34%. Comparing base (ab3f6c1) to head (df0206f). Report is 3 commits behind head on master.

Files Patch % Lines
analyzers/conversion_overflow.go 77.35% 7 Missing and 5 partials :warning:

:exclamation: Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #1189 +/- ## ========================================== + Coverage 67.30% 67.34% +0.03% ========================================== Files 74 74 Lines 3992 4045 +53 ========================================== + Hits 2687 2724 +37 - Misses 1186 1195 +9 - Partials 119 126 +7 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

ccojocar commented 2 weeks ago

@czechbol It seems that there some more use cases to handle https://github.com/securego/gosec/issues/1187#issuecomment-2311308184. I would be great if you could also check the bounds. Thanks