feat(ci): add sast tools gosec and semgrep

Signed-off-by: zhaochenyang <zhaochenyang@oppo.com>

.github/workflows/ci.yml

@@ -98,3 +98,16 @@ jobs:
           name: docker_data
           path: docker/docker_data.tar.gz
           retention-days: 7
+
+  ci-sast:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+      - name: Run Semgrep Security Scanner
+        uses: returntocorp/semgrep-action@fcd5ab7459e8d91cb1777481980d1b18b4fc6735 # v1
+
+      - name: Run Gosec Security Scanner
+        run: |
+          docker/run_docker.sh --gosec

.semgrep.yml

@@ -0,0 +1,26 @@
+rules:
+  - id: rfc-5737-ip-address
+    languages:
+      - go
+    message: Where a real IPv4 address isn't needed, use IPv4 addresses from RFC5737.
+    paths:
+      include:
+        - '*.go'
+    patterns:
+      - pattern-regex: '(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'
+      - pattern-not-regex: '10\.\d+\.\d+.\d+'
+      - pattern-not-regex: '192\.168\.\d+.\d+'
+      - pattern-not-regex: '192\.0\.2\.\d+'    # 192.0.2.0/24 (TEST-NET-1, rfc5737)
+      - pattern-not-regex: '198\.51\.100\.\d+' # 198.51.100.0/24 (TEST-NET-2, rfc5737)
+      - pattern-not-regex: '203\.0\.113\.\d+'  # 203.0.113.0/24 (TEST-NET-3, rfc5737)
+    severity: WARNING
+  - id: rfc-3849-ip-address
+    languages:
+      - go
+    message: Where a real IPv6 address isn't needed, use IPv6 addresses from RFC3849.
+    paths:
+      include:
+        - '*.go'
+    patterns:
+      - pattern-regex: '(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))'
+    severity: WARNING

docker/docker-compose.yml

@@ -562,3 +562,15 @@ services:
                 set -e;
                 cd ${CFSROOT}/blobstore &&
                 /go/bin/golangci-lint run --timeout 10m --issues-exit-code=1 -D errcheck -E bodyclose ./...
+
+    gosec:
+        image: ${IMAGE}
+        volumes:
+            - ../:${CFSROOT}
+        command:
+            - bash
+            - "-c"
+            - >-
+                set -e;
+                cd ${CFSROOT} &&
+                /go/bin/gosec -severity=high -exclude-dir=depends -exclude-dir=vendor -exclude-dir=autofs -exclude=G404 ./...

docker/run_docker.sh

@@ -56,6 +56,11 @@ run_bsgolint() {
     ${compose} run bs_golint
 }
 
+run_gosec() {
+    prepare
+    ${compose} run gosec
+}
+
 # build
 build() {
     prepare
@@ -153,6 +158,9 @@ for opt in ${ARGS[*]} ; do
         --bsgolint)
             cmd=run_bsgolint
             ;;
+        --gosec)
+            cmd=run_gosec
+            ;;
         -clean|--clean)
             cmd=clean
             ;;
@@ -206,6 +214,7 @@ case "-$cmd" in
     -run_s3test) run_s3test ;;
     -run_bsgofumpt) run_bsgofumpt ;;
     -run_bsgolint) run_bsgolint ;;
+    -run_gosec) run_gosec ;;
     -clean) clean ;;
     *) help ;;
 esac

objectnode/auth.go

@@ -107,7 +107,7 @@ const (
 	signV4Algorithm          = "AWS4-HMAC-SHA256"
 	streamingContentEncoding = "aws-chunked"
 
-	credentialFlag    = "Credential="
+	credentialFlag    = "Credential=" // #nosec G101
 	signatureFlag     = "Signature="
 	signedHeadersFlag = "SignedHeaders="
 

objectnode/const.go

@@ -76,13 +76,13 @@ const (
 	XAmzStorageClass                = "x-amz-storage-class"
 	XAmzTaggingCount                = "x-amz-tagging-count"
 	XAmzContentSha256               = "X-Amz-Content-Sha256"
-	XAmzCredential                  = "X-Amz-Credential"
+	XAmzCredential                  = "X-Amz-Credential" // #nosec G101
 	XAmzSignature                   = "X-Amz-Signature"
 	XAmzSignedHeaders               = "X-Amz-SignedHeaders"
 	XAmzAlgorithm                   = "X-Amz-Algorithm"
 	XAmzDate                        = "X-Amz-Date"
 	XAmzExpires                     = "X-Amz-Expires"
-	XAmzSecurityToken               = "X-Amz-Security-Token"
+	XAmzSecurityToken               = "X-Amz-Security-Token" // #nosec G101
 	XAmzObjectLockMode              = "X-Amz-Object-Lock-Mode"
 	XAmzObjectLockRetainUntilDate   = "X-Amz-Object-Lock-Retain-Until-Date"