Skip to content

Commit

Permalink
Modify rule S2092: Add Go language (#2760)
Browse files Browse the repository at this point in the history
  • Loading branch information
sebastien-andrivet-sonarsource authored Jan 28, 2025
1 parent 35c4205 commit 2b798c3
Show file tree
Hide file tree
Showing 2 changed files with 159 additions and 0 deletions.
3 changes: 3 additions & 0 deletions rules/S2092/go/metadata.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
"quickfix": "unknown"
}
156 changes: 156 additions & 0 deletions rules/S2092/go/rule.adoc
Original file line number Diff line number Diff line change
@@ -0,0 +1,156 @@
include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

For https://pkg.go.dev/std[Go Standard Library]:

[source,go,diff-id=1,diff-type=noncompliant]
----
import "net/http"
func handler(w http.ResponseWriter, req *http.Request) {
cookie := http.Cookie{}
cookie.Name = "cookiename"
cookie.Value = "cookievalue"
http.SetCookie(w, &cookie) // Sensitive: Secure is false by default
}
----

For https://pkg.go.dev/github.com/beego/beego/v2/server/web[Beego]:

[source,go,diff-id=2,diff-type=noncompliant]
----
import "github.com/beego/beego/v2/server/web"
func (ctrl *MainController) handler() {
ctrl.Ctx.SetCookie("name1", "value1", 200, "/", "example.com", false, false) // Sensitive
}
----

For https://pkg.go.dev/github.com/gofiber/fiber/v2[Fiber]:

[source,go,diff-id=3,diff-type=noncompliant]
----
import "github.com/gofiber/fiber/v2"
func handler(c *fiber.Ctx) error {
cookie := new(fiber.Cookie)
cookie.Name = "name"
cookie.Value = "value"
c.Cookie(cookie) // Sensitive: Secure is false by default
return c.SendString("")
}
----

For https://pkg.go.dev/github.com/gin-gonic/gin[Gin]:

[source,go,diff-id=4,diff-type=noncompliant]
----
import "github.com/gin-gonic/gin"
func handler(c *gin.Context) {
c.SetCookie("name", "value", 200, "/", "example.com", false, false) // Sensitive
c.JSON(http.StatusOK, gin.H{"message": ""})
}
----

== Compliant Solution

For https://pkg.go.dev/std[Go Standard Library]:

[source,go,diff-id=1,diff-type=compliant]
----
import "net/http"
func handler(w http.ResponseWriter, req *http.Request) {
cookie := http.Cookie{}
cookie.Name = "cookiename"
cookie.Value = "cookievalue"
cookie.Secure = true
http.SetCookie(w, &cookie)
}
----

For https://pkg.go.dev/github.com/beego/beego/v2/server/web[Beego]:

[source,go,diff-id=2,diff-type=compliant]
----
import "github.com/beego/beego/v2/server/web"
func (ctrl *MainController) handler() {
ctrl.Ctx.SetCookie("name1", "value1", 200, "/", "example.com", true, false)
}
----

For https://pkg.go.dev/github.com/gofiber/fiber/v2[Fiber]:

[source,go,diff-id=3,diff-type=compliant]
----
import "github.com/gofiber/fiber/v2"
func handler(c *fiber.Ctx) error {
cookie := new(fiber.Cookie)
cookie.Name = "name"
cookie.Value = "value"
cookie.Secure = true
c.Cookie(cookie)
return c.SendString("")
}
----

For https://pkg.go.dev/github.com/gin-gonic/gin[Gin]:

[source,go,diff-id=4,diff-type=compliant]
----
import "github.com/gin-gonic/gin"
func handler(c *gin.Context) {
c.SetCookie("name", "value", 200, "/", "example.com", true, false)
c.JSON(http.StatusOK, gin.H{"message": ""})
}
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

=== Highlighting

For Go Standard Library:

* Highlight `SetCookie` if it is assigned an `http.Cookie` that has not `Secure` field specified.
* Highlight `Secure` field of `http.Cookie` if it is set to `false`.

For Beego:

* Highlight the 6th argument of `web.Controller.Context.SetCookie` if it is set to `false`.
* Highlight the 6th argument of `web.Controller.Context.Output.Cookie` if it is set to `false`.
* Highlight the 6th argument of `web.Controller.Context.SetSecureCookie` if it is set to `false`.

For Fiber:

* Highlight `Cookie` if it is assigned a `fiber.Cookie` that has not `Secure` field specified.
* Highlight `Secure` field of `fiber.Cookie` if it is set to `false`.

For Gin:

* Highlight the 6th argument of `gin.Context.SetCookie` if it is set to `false`.


'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]

endif::env-github,rspecator-view[]

0 comments on commit 2b798c3

Please sign in to comment.