Develop

go.mod

@@ -5,48 +5,42 @@ go 1.16
 require (
 	github.com/DATA-DOG/go-sqlmock v1.5.0
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
-	github.com/auth0/go-jwt-middleware v1.0.0
-	github.com/dgrijalva/jwt-go v3.2.0+incompatible
-	github.com/form3tech-oss/jwt-go v3.2.2+incompatible
+	github.com/form3tech-oss/jwt-go v3.2.3+incompatible // indirect
 	github.com/go-chi/chi v4.1.2+incompatible
 	github.com/go-chi/cors v1.2.0
+	github.com/go-openapi/jsonreference v0.19.6 // indirect
 	github.com/go-openapi/spec v0.20.3 // indirect
 	github.com/go-openapi/swag v0.19.15 // indirect
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
+	github.com/golang-jwt/jwt v3.2.1+incompatible
 	github.com/golang/protobuf v1.5.2
-	github.com/google/uuid v1.2.0
+	github.com/google/uuid v1.3.0
 	github.com/gopherjs/gopherjs v0.0.0-20210420193930-a4630ec28c79 // indirect
-	github.com/iancoleman/strcase v0.1.3
-	github.com/jackc/pgproto3/v2 v2.0.7 // indirect
-	github.com/jackc/pgx/v4 v4.11.0 // indirect
-	github.com/magiconair/properties v1.8.5 // indirect
+	github.com/gorilla/mux v1.7.4 // indirect
+	github.com/iancoleman/strcase v0.2.0
+	github.com/jackc/pgx/v4 v4.12.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mitchellh/mapstructure v1.4.1 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible
-	github.com/pelletier/go-toml v1.9.0 // indirect
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.10.0
-	github.com/prometheus/common v0.23.0 // indirect
+	github.com/prometheus/client_golang v1.11.0
+	github.com/prometheus/common v0.29.0 // indirect
+	github.com/prometheus/procfs v0.7.0 // indirect
 	github.com/sirupsen/logrus v1.8.1
 	github.com/smartystreets/assertions v1.2.0 // indirect
 	github.com/smartystreets/goconvey v1.6.4
-	github.com/spf13/afero v1.6.0 // indirect
-	github.com/spf13/cast v1.3.1 // indirect
-	github.com/spf13/cobra v1.1.3
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/viper v1.7.1
+	github.com/spf13/cobra v1.2.1
+	github.com/spf13/viper v1.8.1
 	github.com/streadway/amqp v1.0.0
 	github.com/stretchr/objx v0.3.0 // indirect
 	github.com/stretchr/testify v1.7.0
 	github.com/swaggo/http-swagger v1.0.0
-	golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b
-	golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420 // indirect
-	golang.org/x/sys v0.0.0-20210503080704-8803ae5d1324 // indirect
-	google.golang.org/genproto v0.0.0-20210429181445-86c259c2b4ab // indirect
-	google.golang.org/grpc v1.37.0
-	google.golang.org/protobuf v1.26.0
-	gopkg.in/ini.v1 v1.62.0 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
-	gorm.io/driver/postgres v1.0.8
-	gorm.io/gorm v1.21.9
+	github.com/urfave/negroni v1.0.0 // indirect
+	golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97
+	golang.org/x/net v0.0.0-20210614182718-04defd469f4e // indirect
+	golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c // indirect
+	google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a // indirect
+	google.golang.org/grpc v1.39.0
+	google.golang.org/protobuf v1.27.1
+	gorm.io/driver/postgres v1.1.0
+	gorm.io/gorm v1.21.11
 )

horusec-config.json

@@ -4,12 +4,14 @@
     "**/*_mock.go"
   ],
   "horusecCliFalsePositiveHashes": [
+    "d27c6d5c5cf52ac06230dfbb64d478347fdf519a4bffd0dacc5f13615fecdb58",
+    "77171bf171155ece644b90ed5642605d2a65a2e538efc9ca0a1ed2e00ccd66eb",
     "845568e867ff683f105696af504600fa388337999153a0008ef52310cf4e47e4",
     "5bf85178b581e1fe688646df2ba8727a7842104b5cc8ab7df2cb4c3adf771672",
     "1456a86372dd8793604942c675a25be8f0d2a2122b61b5ad78810115c394abf9",
-    "d27c6d5c5cf52ac06230dfbb64d478347fdf519a4bffd0dacc5f13615fecdb58",
-    "77171bf171155ece644b90ed5642605d2a65a2e538efc9ca0a1ed2e00ccd66eb",
     "19f896c1ed2de0ce6d335a10b852325d266f154a234a51ed879b6e7e37a3edf2",
-    "4a772afe9fa2edecba75c4c6ddff385662d137b42dcacb46a78ba327bf8d90a0"
+    "4a772afe9fa2edecba75c4c6ddff385662d137b42dcacb46a78ba327bf8d90a0",
+    "b9f0d3772a885673b4a968d21eb9c350d25aae332b7c1a9bf113b5af24704ff9",
+    "e8c6a9744859f048a44a4eb160ce0e22df524507a288cfbfcbfcdc26d2533c63"
   ]
 }

pkg/enums/tools/tools.go

@@ -1,4 +1,4 @@
-// Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+// Copyright 2021 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -38,6 +38,7 @@ const (
 	BundlerAudit         Tool = "BundlerAudit"
 	OwaspDependencyCheck Tool = "OwaspDependencyCheck"
 	DotnetCli            Tool = "DotnetCli"
+	Nancy                Tool = "Nancy"
 )
 
 func (t Tool) ToString() string {
@@ -70,5 +71,6 @@ func Values() []Tool {
 		BundlerAudit,
 		OwaspDependencyCheck,
 		DotnetCli,
+		Nancy,
 	}
 }

pkg/enums/tools/tools_test.go

@@ -41,6 +41,7 @@ func TestToString(t *testing.T) {
 		assert.Equal(t, "BundlerAudit", BundlerAudit.ToString())
 		assert.Equal(t, "OwaspDependencyCheck", OwaspDependencyCheck.ToString())
 		assert.Equal(t, "DotnetCli", DotnetCli.ToString())
+		assert.Equal(t, "Nancy", Nancy.ToString())
 	})
 }
 
@@ -65,11 +66,12 @@ func TestToLowerCase(t *testing.T) {
 		assert.Equal(t, "bundlerAudit", BundlerAudit.ToLowerCamel())
 		assert.Equal(t, "owaspDependencyCheck", OwaspDependencyCheck.ToLowerCamel())
 		assert.Equal(t, "dotnetCli", DotnetCli.ToLowerCamel())
+		assert.Equal(t, "nancy", Nancy.ToLowerCamel())
 	})
 }
 
 func TestValues(t *testing.T) {
-	t.Run("should return 19 valid values", func(t *testing.T) {
-		assert.Len(t, Values(), 19)
+	t.Run("should return 20 valid values", func(t *testing.T) {
+		assert.Len(t, Values(), 20)
 	})
 }

pkg/utils/jwt/entities/jwt_claims.go

@@ -15,9 +15,9 @@
 package entities
 
 import (
-	"github.com/dgrijalva/jwt-go"
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/golang-jwt/jwt"
 	"github.com/google/uuid"
 
 	"github.com/ZupIT/horusec-devkit/pkg/enums/ozzovalidation"

pkg/utils/jwt/entities/jwt_claims_test.go

@@ -17,7 +17,7 @@ package entities
 import (
 	"testing"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 )

pkg/utils/jwt/jwt.go

@@ -21,8 +21,8 @@ import (
 	"time"
 
 	jwtMiddleware "github.com/auth0/go-jwt-middleware"
-	"github.com/dgrijalva/jwt-go"
 	jwtGO "github.com/form3tech-oss/jwt-go"
+	"github.com/golang-jwt/jwt"
 	"github.com/google/uuid"
 
 	"github.com/ZupIT/horusec-devkit/pkg/utils/env"

pkg/utils/logger/logger.go

@@ -15,9 +15,9 @@
 package logger
 
 import (
-	"bytes"
 	"encoding/json"
 	"fmt"
+	"io"
 	"log"
 
 	"github.com/sirupsen/logrus"
@@ -52,7 +52,6 @@ func LogInfo(msg string, args ...interface{}) {
 		logrus.Info(msg, args)
 		return
 	}
-
 	logrus.Info(msg)
 }
 
@@ -158,6 +157,7 @@ func LogDebugJSON(message string, content interface{}) {
 	LogDebugWithLevel(message, fmt.Sprintf("%v", content))
 }
 
-func LogSetOutput(stdout *bytes.Buffer) {
-	logrus.SetOutput(stdout)
+func LogSetOutput(writers ...io.Writer) {
+	mw := io.MultiWriter(writers...)
+	logrus.SetOutput(mw)
 }

pkg/utils/logger/logger_test.go

@@ -17,6 +17,8 @@ package logger
 import (
 	"bytes"
 	"errors"
+	"io/ioutil"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -173,7 +175,7 @@ func TestLogDebugJSON(t *testing.T) {
 }
 
 func TestLogSetOutput(t *testing.T) {
-	t.Run("Should set output instance and get on read output", func(t *testing.T) {
+	t.Run("Should set output instance without file and get on read output", func(t *testing.T) {
 		output := bytes.NewBufferString("")
 		LogSetOutput(output)
 		assert.Empty(t, output.String())
@@ -183,4 +185,36 @@ func TestLogSetOutput(t *testing.T) {
 
 		assert.Contains(t, output.String(), textLogged)
 	})
+	t.Run("Should set output instance with file and get on read output and file", func(t *testing.T) {
+		output := bytes.NewBufferString("")
+		file, err := os.Create("./testSetOutput")
+		if err != nil {
+			t.Error(err)
+		}
+		defer func() {
+			err := os.Remove(file.Name())
+			if err != nil {
+				t.Error()
+			}
+		}()
+		LogSetOutput(output, file)
+		assert.Empty(t, output.String())
+
+		const textLogged = "Some aleatory text logged"
+		LogInfo(textLogged)
+		byteSlice, err := ioutil.ReadFile(file.Name())
+		if err != nil {
+			t.Error(err)
+		}
+		assert.Contains(t, output.String(), textLogged)
+		assert.Contains(t, string(byteSlice), textLogged)
+
+	})
+	t.Run("Should set output instance with invalid writer and panic", func(t *testing.T) {
+		assert.Panics(t, func() {
+			LogSetOutput(nil, &os.File{})
+			LogInfo("Should panic")
+		})
+	})
+
 }