iterate-over-empty-map.yaml

rules:
  - id: iterate-over-empty-map
    message: >-
      Iteration over a possibly empty map `$C`. This is likely a bug or redundant code
    languages: [go]
    severity: WARNING
    metadata:
      category: security
      cwe: "CWE-665: Improper Initialization"
      subcategory: [audit]
      confidence: MEDIUM
      likelihood: LOW
      impact: LOW
      technology: [--no-technology--]
      description: "Probably redundant iteration over an empty map"
      references:
        - https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/

    patterns:
      - pattern: |
          $C = make(map[$T1] $T2, ...)
          ...
          for $K := range $C { ... }
      - pattern-not: |
          $C = make(map[$T1] $T2, ...)
          ...
          $C[$X] = $V
          ...
          for $K := range $C { ... }
      - pattern-not: |
          $C = make(map[$T1] $T2, ...)
          ...
          $C[$X]++
          ...
          for $K := range $C { ... }
      - pattern-not: |
          $C = make(map[$T1] $T2, ...)
          ...
          $C[$X]--
          ...
          for $K := range $C { ... }
      - pattern-not: |
          $C = make(map[$T1] $T2, ...)
          ...
          $CODEC.Unmarshal($BYTES, &$C)
          ...
          for $K := range $C { ... }