Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Better ci #40

Merged
merged 8 commits into from
Jan 2, 2024
Merged

Better ci #40

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
3c6c867
add prettier linter, fix job ids
GrosQuildu Jan 2, 2024
c12bb5b
prettify all rules, add git-blame exception
GrosQuildu Jan 2, 2024
85218e1
git blame - provide commit
GrosQuildu Jan 2, 2024
ab5507f
auto-validate schema
GrosQuildu Jan 2, 2024
4a5d2f1
fix py deps
GrosQuildu Jan 2, 2024
9be0a0a
use semgrep to test rules
GrosQuildu Jan 2, 2024
8c9844f
fix from lints
GrosQuildu Jan 2, 2024
250c4b1
fix job name
GrosQuildu Jan 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .git-blame-ignore-revs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Formatted Semgrep YAML files using prettier
c12bb5b7bf893466c24bdad5b234dcd3ad3b42df
21 changes: 21 additions & 0 deletions .github/workflows/semgrep-rules-format.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
name: semgrep-rules-format
on:
pull_request:
push:
branches:
- main
jobs:
semgrep-rules-format:
name: run semgrep rules format
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
cache: "npm"
# Use this file as the cache-dependency-path because the dependencies
# are manually specified below, and not in a package-lock.json
cache-dependency-path: .github/workflows/semgrep-rules-format.yml
- run: npm install --global prettier
- run: prettier --check './**/*.{yaml,yml}'
10 changes: 9 additions & 1 deletion .github/workflows/semgrep-rules-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ on:
branches:
- main
jobs:
build:
semgrep-rules-test:
name: run semgrep rules tests
runs-on: ubuntu-latest
steps:
Expand All @@ -18,7 +18,15 @@ jobs:
run: |
python -m pip install --upgrade pip
python3 -m pip install semgrep
python3 -m pip install jsonschema pyyaml
- name: validations
run: semgrep --validate --config .
- name: tests
run: semgrep --test --test-ignore-todo
- name: metadata-tests
run: |
wget https://raw.githubusercontent.com/returntocorp/semgrep-rules/c5ad4bb0f4c7ee5b8cd47276b582e8bb57bd0a4d/.github/scripts/validate-metadata.py
wget https://raw.githubusercontent.com/returntocorp/semgrep-rules/develop/metadata-schema.yaml.schm
python ./validate-metadata.py -s ./metadata-schema.yaml.schm -f .
- name: x
GrosQuildu marked this conversation as resolved.
Show resolved Hide resolved
run: semgrep --config="r/yaml.semgrep" --severity ERROR .
2 changes: 1 addition & 1 deletion .github/workflows/update-semgrep-registry.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ on:
branches:
- main
jobs:
build:
update-semgrep-registry:
name: Update semgrep.dev
runs-on: ubuntu-latest
steps:
Expand Down
166 changes: 83 additions & 83 deletions go/anonymous-race-condition.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,25 +1,77 @@
rules:
- id: anonymous-race-condition
message: >-
Possible race condition due to memory aliasing of variable `$X`
languages: [go]
severity: ERROR
metadata:
category: security
cwe: "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
subcategory: [vuln]
confidence: MEDIUM
likelihood: HIGH
impact: MEDIUM
technology: [--no-technology--]
description: "Race conditions within anonymous goroutines"
references:
- https://github.com/golang/go/wiki/CommonMistakes#using-goroutines-on-loop-iterator-variables
- id: anonymous-race-condition
message: >-
Possible race condition due to memory aliasing of variable `$X`
languages: [go]
severity: ERROR
metadata:
category: security
cwe: "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
subcategory: [vuln]
confidence: MEDIUM
likelihood: HIGH
impact: MEDIUM
technology: [--no-technology--]
description: "Race conditions within anonymous goroutines"
references:
- https://github.com/golang/go/wiki/CommonMistakes#using-goroutines-on-loop-iterator-variables

patterns:
- pattern-either:
- pattern: |
for $Y, $X := range ... {
patterns:
- pattern-either:
- pattern: |
for $Y, $X := range ... {
...
go func(...){
...
$FOO(..., $X, ...)
...
}(...)
...
}
- pattern: |
for $Y, $X := range ... {
...
go func(...){
...
$FOO(..., $Y, ...)
...
}(...)
...
}
- pattern: |
for $Y, $X := range ... {
...
go func(...){
...
$X(...)
...
}(...)
...
}
- pattern: |
for $X:=...;$Y;$Z {
...
go func(...) {
...
$FOO(..., $X,...)
...
}(...)
...
}
- pattern: |
for $Y, $X := range ... {
...
go func(...){
...
$X. ... .$M(...)
...
}(...)
...
}
- pattern-not: |
for ..., $X := range ... {
...
..., $X := ..., $X
...
go func(...){
...
Expand All @@ -28,77 +80,25 @@ rules:
}(...)
...
}
- pattern: |
for $Y, $X := range ... {
...
go func(...){
...
$FOO(..., $Y, ...)
...
}(...)
...
}
- pattern: |
for $Y, $X := range ... {
...
go func(...){
- pattern-not: |
for ..., $X := range ... {
...
$X(...)
...
}(...)
...
}
- pattern: |
for $X:=...;$Y;$Z {
...
go func(...) {
$X, ... := $X, ...
...
$FOO(..., $X,...)
go func(...){
...
$FOO(..., $X, ...)
...
}(...)
...
}(...)
...
}
- pattern: |
- pattern-not: |
for $Y, $X := range ... {
...
go func(...){
...
$X. ... .$M(...)
...
}(...)
...
}
- pattern-not: |
for ..., $X := range ... {
...
..., $X := ..., $X
...
go func(...){
...
$FOO(..., $X, ...)
...
}(...)
...
}
- pattern-not: |
for ..., $X := range ... {
...
$X, ... := $X, ...
$Y, $X := $Y, $X
...
go func(...){
...
$FOO(..., $X, ...)
...
}(...)
...
}
- pattern-not: |
for $Y, $X := range ... {
...
$Y, $X := $Y, $X
...
go func(...){
...
}(...)
...
}
}
Loading
Loading