fixed: lint and sec

PaloAltoNetworks · Mar 6, 2020 · 8701522 · 8701522
1 parent e10f466
commit 8701522
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 9 deletions.
diff --git a/tglib/pkcs12.go b/tglib/pkcs12.go
@@ -50,8 +50,12 @@ func GeneratePKCS12(cert []byte, key []byte, ca []byte, passphrase string) ([]by
 	if err != nil {
 		return nil, err
 	}
+	// #nosec G307
 	defer os.Remove(tmpcert.Name()) // nolint: errcheck
-	defer tmpcert.Close()           // nolint: errcheck
+
+	// #nosec G307
+	defer tmpcert.Close() // nolint: errcheck
+
 	if _, err = tmpcert.Write(cert); err != nil {
 		return nil, err
 	}
@@ -61,8 +65,13 @@ func GeneratePKCS12(cert []byte, key []byte, ca []byte, passphrase string) ([]by
 	if err != nil {
 		return nil, err
 	}
+
+	// #nosec G307
 	defer os.Remove(tmpkey.Name()) // nolint: errcheck
-	defer tmpkey.Close()           // nolint: errcheck
+
+	// #nosec G307
+	defer tmpkey.Close() // nolint: errcheck
+
 	if _, err = tmpkey.Write(key); err != nil {
 		return nil, err
 	}
@@ -72,8 +81,13 @@ func GeneratePKCS12(cert []byte, key []byte, ca []byte, passphrase string) ([]by
 	if err != nil {
 		return nil, err
 	}
+
+	// #nosec G307
 	defer os.Remove(tmpca.Name()) // nolint: errcheck
-	defer tmpca.Close()           // nolint: errcheck
+
+	// #nosec G307
+	defer tmpca.Close() // nolint: errcheck
+
 	if _, err = tmpca.Write(ca); err != nil {
 		return nil, err
 	}
@@ -83,8 +97,12 @@ func GeneratePKCS12(cert []byte, key []byte, ca []byte, passphrase string) ([]by
 	if err != nil {
 		return nil, err
 	}
+
+	// #nosec G307
 	defer os.Remove(tmpp12.Name()) // nolint: errcheck
-	defer tmpp12.Close()           // nolint: errcheck
+
+	// #nosec G307
+	defer tmpp12.Close() // nolint: errcheck
 
 	if err = GeneratePKCS12FromFiles(tmpp12.Name(), tmpcert.Name(), tmpkey.Name(), tmpca.Name(), passphrase); err != nil {
 		return nil, err

diff --git a/tgnoob/helpers.go b/tgnoob/helpers.go
@@ -163,15 +163,15 @@ func GenerateCertificate(
 	if err = ioutil.WriteFile(
 		keyOut,
 		pem.EncodeToMemory(priv),
-		0644,
+		0600,
 	); err != nil {
 		return fmt.Errorf("unable to write private key on file: %s", err.Error())
 	}
 
 	if err = ioutil.WriteFile(
 		certOut,
 		pem.EncodeToMemory(pub),
-		0644,
+		0600,
 	); err != nil {
 		return fmt.Errorf("unable to write public key on file: %s", err.Error())
 	}
@@ -309,7 +309,7 @@ func GenerateCSR(
 		if err = ioutil.WriteFile(
 			keyOut,
 			pem.EncodeToMemory(keyBlock),
-			0644,
+			0600,
 		); err != nil {
 			return fmt.Errorf("unable to write private key on file: %s", err.Error())
 		}
@@ -341,7 +341,7 @@ func GenerateCSR(
 	if err := ioutil.WriteFile(
 		csrOut,
 		csrBytes,
-		0644,
+		0600,
 	); err != nil {
 		return fmt.Errorf("unable to write public key on file: %s", err.Error())
 	}
@@ -475,7 +475,7 @@ func SignCSR(
 			if err = ioutil.WriteFile(
 				certOut,
 				pem.EncodeToMemory(certBlock),
-				0644,
+				0600,
 			); err != nil {
 				return fmt.Errorf("unable to write certificate on file: %s", err.Error())
 			}