Skip to content

Commit

Permalink
Merge pull request #21800 from hashicorp/svgpkg-semgrep
Browse files Browse the repository at this point in the history 
Linting: Restores more Semgrep rules
  • Loading branch information
@gdavison
gdavison authored Nov 18, 2021
2 parents e74677d + 32354f9 commit ef6cf6e
Show file tree
Hide file tree
Showing 58 changed files with 279 additions and 741 deletions.
113 changes: 57 additions & 56 deletions .semgrep.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,27 +43,24 @@ rules:
languages: [go]
message: Prefer AWS Go SDK pointer conversion functions for dereferencing during assignment, e.g. aws.StringValue()
paths:
exclude:
- aws/cloudfront_distribution_configuration_structure.go
- aws/data_source_aws_route_table.go
- aws/opsworks_layers.go
- aws/resource_aws_d*
- aws/resource_aws_e*
- aws/resource_aws_g*
- aws/resource_aws_i*
- aws/resource_aws_k*
- aws/resource_aws_l*
- aws/resource_aws_mq_broker.go
- aws/resource_aws_o*
- aws/resource_aws_r*
- aws/resource_aws_s*
- aws/structure.go
- aws/waf_helpers.go
- aws/internal/generators/
- aws/internal/keyvaluetags/
- providerlint/vendor/
include:
- aws/
- internal/service
exclude:
- internal/service/ec2
- internal/service/elasticbeanstalk
- internal/service/elasticsearch
- internal/service/elb
- internal/service/emr
- internal/service/gamelift
- internal/service/iam
- internal/service/lambda
- internal/service/opsworks
- internal/service/rds
- internal/service/redshift
- internal/service/route53
- internal/service/s3
- internal/service/servicediscovery
- internal/service/ssm
patterns:
- pattern: '$LHS = *$RHS'
- pattern-not: '*$LHS2 = *$RHS'
Expand Down Expand Up @@ -121,7 +118,7 @@ rules:
message: Prefer AWS Go SDK pointer conversion aws.StringValue() function for dereferencing during d.SetId()
paths:
include:
- aws/
- internal/
pattern: 'd.SetId(*$VALUE)'
severity: WARNING

Expand All @@ -131,7 +128,7 @@ rules:
message: Using AWS Go SDK pointer conversion, e.g. aws.String(), with immediate dereferencing is extraneous
paths:
include:
- aws/
- internal/
patterns:
- pattern-either:
- pattern: '*aws.Bool($VALUE)'
Expand All @@ -146,7 +143,7 @@ rules:
message: Calling a resource's Read method from within a data-source is discouraged
paths:
include:
- aws/data_source_aws_*.go
- internal/service/**/*_data_source.go
patterns:
- pattern-regex: '(resource.+Read|flatten.+Resource)'
- pattern-inside: func $FUNCNAME(...) $RETURNTYPE { ... }
Expand All @@ -164,7 +161,7 @@ rules:
message: Using `acctest.RandInt()` in constant or variable declaration will execute during compilation and not randomize, pass into string generating function instead
paths:
include:
- aws/
- internal/
patterns:
- pattern-either:
- pattern: const $CONST = fmt.Sprintf(..., <... acctest.RandInt() ...>, ...)
Expand All @@ -176,7 +173,7 @@ rules:
message: Using `acctest.RandString()` in constant or variable declaration will execute during compilation and not randomize, pass into string generating function instead
paths:
include:
- aws/
- internal/
patterns:
- pattern-either:
- pattern: const $CONST = fmt.Sprintf(..., <... acctest.RandString(...) ...>, ...)
Expand All @@ -188,7 +185,7 @@ rules:
message: Using `acctest.RandomWithPrefix()` in constant or variable declaration will execute during compilation and not randomize, pass into string generating function instead
paths:
include:
- aws/
- internal/
patterns:
- pattern-either:
- pattern: const $CONST = fmt.Sprintf(..., <... acctest.RandomWithPrefix(...) ...>, ...)
Expand All @@ -200,7 +197,7 @@ rules:
message: Prefer `flattenStringSet()` function for casting a list of string pointers to a set
paths:
include:
- aws/
- internal/
pattern: schema.NewSet(schema.HashString, flattenStringList($APIOBJECT))
severity: WARNING

Expand All @@ -209,7 +206,7 @@ rules:
message: Prefer `expandStringSet()` function for casting a set to a list of string pointers
paths:
include:
- aws/
- internal/
patterns:
- pattern-either:
- pattern: expandStringList($SET.List())
Expand All @@ -224,7 +221,7 @@ rules:
message: Zero value conditional check after `d.GetOk()` is extraneous
paths:
include:
- aws/
- internal/
patterns:
- pattern-either:
- pattern: if $VALUE, $OK := d.GetOk($KEY); $OK && $VALUE.(bool) { $BODY }
Expand All @@ -240,7 +237,7 @@ rules:
message: AWS Go SDK pointer conversion function for `d.Set()` value is extraneous
paths:
include:
- aws/
- internal/
patterns:
- pattern-either:
- pattern: d.Set($ATTRIBUTE, aws.BoolValue($APIOBJECT))
Expand All @@ -251,28 +248,29 @@ rules:
- pattern: d.Set($ATTRIBUTE, aws.StringValue($APIOBJECT))
severity: WARNING

- id: helper-schema-ResourceData-DataSource-Set-tags
languages: [go]
message: (schema.ResourceData).Set() call with the tags key should include IgnoreConfig in the value
paths:
include:
- aws/data_source*.go
exclude:
- aws/resource*.go
patterns:
- pattern-inside: func $READMETHOD(...) $ERRORTYPE { ... }
- pattern: if err := d.Set("tags", $TAGSMAP); err != nil { ... }
- pattern-not: if err := d.Set("tags", $KEYVALUETAGS.IgnoreAws().IgnoreConfig($CONFIG).Map()); err != nil { ... }
severity: WARNING
# Not sure why this isn't working
# - id: helper-schema-ResourceData-DataSource-Set-tags
# languages: [go]
# message: (schema.ResourceData).Set() call with the tags key should include IgnoreConfig in the value
# paths:
# include:
# - internal/service/**/*_data_source.go
# exclude:
# - internal/service/**/*.go
# patterns:
# - pattern-inside: func $READMETHOD(...) $ERRORTYPE { ... }
# - pattern: if err := d.Set("tags", $TAGSMAP); err != nil { ... }
# - pattern-not: if err := d.Set("tags", $KEYVALUETAGS.IgnoreAws().IgnoreConfig($CONFIG).Map()); err != nil { ... }
# severity: WARNING

- id: helper-schema-ResourceData-Resource-Set-tags
languages: [go]
message: (schema.ResourceData).Set() call with the tags key should be preceded by a call to IgnoreConfig or include IgnoreConfig in the value in the case of ASG
paths:
include:
- aws/resource*.go
- internal/service/**/*.go
exclude:
- aws/data_source*.go
- internal/service/**/*_data_source.go
patterns:
- pattern-inside: func $READMETHOD(...) $ERRORTYPE { ... }
- pattern-either:
Expand Down Expand Up @@ -301,6 +299,9 @@ rules:
- pattern-not: |
tags = keyvaluetags.$VALUETAGS($RESOURCETAGS).IgnoreAws().IgnoreConfig($CONFIG)
...
- pattern-not: |
tags = $VALUETAGS($RESOURCETAGS).IgnoreAWS().IgnoreConfig($CONFIG).Ignore($IGNORE)
...
severity: WARNING

- id: helper-schema-ResourceData-SetId-empty-without-IsNewResource-check
Expand Down Expand Up @@ -352,9 +353,9 @@ rules:
paths:
exclude:
- "*_test.go"
- aws/internal/tfresource/*.go
- sweep.go
include:
- aws/
- internal/
patterns:
- pattern-either:
- patterns:
Expand Down Expand Up @@ -434,7 +435,7 @@ rules:
exclude:
- "*_test.go"
include:
- aws/
- internal/
patterns:
- pattern-either:
- patterns:
Expand Down Expand Up @@ -486,7 +487,7 @@ rules:
message: Check for resource.NotFoundError errors with tfresource.NotFound()
paths:
include:
- aws/
- internal/
patterns:
- pattern-either:
- patterns:
Expand All @@ -510,7 +511,7 @@ rules:
message: Use time.Equal() instead of ==
paths:
include:
- aws/
- internal/
patterns:
- pattern-either:
- pattern: |
Expand All @@ -536,7 +537,7 @@ rules:
message: Use lastPage for bool variable in pagination functions
paths:
include:
- aws/
- internal/
patterns:
- pattern: |
$X.$Z(..., func(..., $Y bool) {
Expand All @@ -559,10 +560,10 @@ rules:
languages: [go]
message: Do not call `fmt.Print` and variant
paths:
include:
- internal/
exclude:
- providerlint/vendor/
include:
- aws/
patterns:
- pattern-either:
- pattern: |
Expand Down Expand Up @@ -595,7 +596,7 @@ rules:
message: Use default email address or generate a random email address. https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/contributing/running-and-writing-acceptance-tests.md#hardcoded-email-addresses
paths:
include:
- aws/
- internal/
patterns:
- pattern-regex: '[-_A-Za-z0-9.+]+@([-A-Za-z0-9]+\.)(com|net|org)'
- pattern-not-regex: 'no-reply@hashicorp\.com'
Expand All @@ -607,7 +608,7 @@ rules:
message: Generate random SSH keys using acctest.RandSSHKeyPair() or RandSSHKeyPairSize(). https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/contributing/running-and-writing-acceptance-tests.md#hardcoded-ssh-key
paths:
include:
- aws/
- internal/
exclude:
- providerlint/vendor/
patterns:
Expand All @@ -622,7 +623,7 @@ rules:
message: Incorrect form of non-tags change detection. https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/contributing/contribution-checklists.md#resource-tagging-code-implementation
paths:
include:
- aws/
- internal/
patterns:
- pattern: 'if d.HasChangeExcept("tags_all") {...}'
severity: WARNING
Expand Down
4 changes: 2 additions & 2 deletions internal/service/apigateway/flex.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -112,11 +112,11 @@ func FlattenThrottleSettings(settings *apigateway.ThrottleSettings) []map[string
if settings != nil {
r := make(map[string]interface{})
if settings.BurstLimit != nil {
r["burst_limit"] = *settings.BurstLimit
r["burst_limit"] = aws.Int64Value(settings.BurstLimit)
}

if settings.RateLimit != nil {
r["rate_limit"] = *settings.RateLimit
r["rate_limit"] = aws.Float64Value(settings.RateLimit)
}

result = append(result, r)
Expand Down
30 changes: 13 additions & 17 deletions internal/service/autoscaling/launch_configuration.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -744,15 +744,11 @@ func readBlockDevicesFromLaunchConfiguration(d *schema.ResourceData, lc *autosca
if len(lc.BlockDeviceMappings) == 0 {
return nil, nil
}
rootDeviceName, err := fetchRootDeviceName(d.Get("image_id").(string), ec2conn)
v, err := fetchRootDeviceName(d.Get("image_id").(string), ec2conn)
if err != nil {
return nil, err
}
if rootDeviceName == nil {
// We do this so the value is empty so we don't have to do nil checks later
var blank string
rootDeviceName = &blank
}
rootDeviceName := aws.StringValue(v)

// Collect existing configured devices, so we can check
// existing value of delete_on_termination below
Expand All @@ -777,41 +773,41 @@ func readBlockDevicesFromLaunchConfiguration(d *schema.ResourceData, lc *autosca
}
bd["delete_on_termination"] = deleteOnTermination
} else if bdm.Ebs != nil && bdm.Ebs.DeleteOnTermination != nil {
bd["delete_on_termination"] = *bdm.Ebs.DeleteOnTermination
bd["delete_on_termination"] = aws.BoolValue(bdm.Ebs.DeleteOnTermination)
}

if bdm.Ebs != nil && bdm.Ebs.VolumeSize != nil {
bd["volume_size"] = *bdm.Ebs.VolumeSize
bd["volume_size"] = aws.Int64Value(bdm.Ebs.VolumeSize)
}
if bdm.Ebs != nil && bdm.Ebs.VolumeType != nil {
bd["volume_type"] = *bdm.Ebs.VolumeType
bd["volume_type"] = aws.StringValue(bdm.Ebs.VolumeType)
}
if bdm.Ebs != nil && bdm.Ebs.Iops != nil {
bd["iops"] = *bdm.Ebs.Iops
bd["iops"] = aws.Int64Value(bdm.Ebs.Iops)
}
if bdm.Ebs != nil && bdm.Ebs.Throughput != nil {
bd["throughput"] = *bdm.Ebs.Throughput
bd["throughput"] = aws.Int64Value(bdm.Ebs.Throughput)
}
if bdm.Ebs != nil && bdm.Ebs.Encrypted != nil {
bd["encrypted"] = *bdm.Ebs.Encrypted
bd["encrypted"] = aws.BoolValue(bdm.Ebs.Encrypted)
}

if bdm.DeviceName != nil && *bdm.DeviceName == *rootDeviceName {
if bdm.DeviceName != nil && aws.StringValue(bdm.DeviceName) == rootDeviceName {
blockDevices["root"] = bd
} else {
if bdm.DeviceName != nil {
bd["device_name"] = *bdm.DeviceName
bd["device_name"] = aws.StringValue(bdm.DeviceName)
}

if bdm.VirtualName != nil {
bd["virtual_name"] = *bdm.VirtualName
bd["virtual_name"] = aws.StringValue(bdm.VirtualName)
blockDevices["ephemeral"] = append(blockDevices["ephemeral"].([]map[string]interface{}), bd)
} else {
if bdm.Ebs != nil && bdm.Ebs.SnapshotId != nil {
bd["snapshot_id"] = *bdm.Ebs.SnapshotId
bd["snapshot_id"] = aws.StringValue(bdm.Ebs.SnapshotId)
}
if bdm.NoDevice != nil {
bd["no_device"] = *bdm.NoDevice
bd["no_device"] = aws.BoolValue(bdm.NoDevice)
}
blockDevices["ebs"] = append(blockDevices["ebs"].([]map[string]interface{}), bd)
}
Expand Down
2 changes: 1 addition & 1 deletion internal/service/autoscaling/sweep.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ func sweepLaunchConfigurations(region string) error {
}

for _, lc := range resp.LaunchConfigurations {
name := *lc.LaunchConfigurationName
name := aws.StringValue(lc.LaunchConfigurationName)

log.Printf("[INFO] Deleting Launch Configuration: %s", name)
_, err := conn.DeleteLaunchConfiguration(
Expand Down
Loading

0 comments on commit ef6cf6e

Please sign in to comment.