Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rules/sdk: G702: Blocklisted import crypto/rand should not flag for crypto related code #63

Closed
odeke-em opened this issue Oct 22, 2022 · 0 comments · Fixed by #64 or #66
Closed

rules/sdk: G702: Blocklisted import crypto/rand should not flag for crypto related code #63

odeke-em opened this issue Oct 22, 2022 · 0 comments · Fixed by #64 or #66
Assignees
@odeke-em

Comments

@odeke-em
Copy link
Collaborator

I've seen a bunch of reports like this

[/go/src/github.com/cosmos/cosmos-sdk/crypto/xsalsa20symmetric/symmetric.go:4] - G702 (CWE-): Blocklisted import crypto/rand (Confidence: HIGH, Severity: MEDIUM)
    3: import (
  > 4: 	"crypto/rand"
    5: 	"errors"



[/go/src/github.com/cosmos/cosmos-sdk/crypto/keys/internal/ecdsa/privkey.go:6] - G702 (CWE-): Blocklisted import crypto/rand (Confidence: HIGH, Severity: MEDIUM)
    5: 	"crypto/elliptic"
  > 6: 	"crypto/rand"
    7: 	"crypto/sha256"



[/go/src/github.com/cosmos/cosmos-sdk/crypto/keys/internal/benchmarking/bench.go:4] - G702 (CWE-): Blocklisted import crypto/rand (Confidence: HIGH, Severity: MEDIUM)
    3: import (
  > 4: 	"crypto/rand"
    5: 	"io"

but really cryptographic code needs RNGs from crypto/rand so as to perform its duties, hence we should exempt code in such files or packages from these false positives
@odeke-em odeke-em self-assigned this Oct 22, 2022
@odeke-em odeke-em mentioned this issue Oct 22, 2022
Merged
odeke-em added a commit that referenced this issue Oct 23, 2022
@odeke-em
rules/sdk: allow hash.Hash.Write to ignore errors since contract permits
da3a18b 
Adds an allowList so that types and methods that don't need
an error check. That reduces false positives.

Fixes #63
odeke-em added a commit that referenced this issue Oct 23, 2022
@odeke-em
rules/sdk: allow hash.Hash.Write et al to ignore errors since contrac…
b14268e 
…t permits

Adds an allowList so that types and methods that don't need
an error check. That reduces false positives.

Fixes #63
@odeke-em odeke-em mentioned this issue Oct 23, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@odeke-em odeke-em

Labels
None yet
Projects
None yet
Milestone
No milestone
1 participant
@odeke-em