Add 'gas' for security problems scanning

Makefile

@@ -17,6 +17,7 @@ GOTEST=go test -v $(RACE)
 GOLINT=golint
 GOVET=go vet
 GOFMT=gofmt
+GAS=gas -exclude=G104
 FMT_LOG=fmt.log
 LINT_LOG=lint.log
 IMPORT_LOG=import.log
@@ -104,8 +105,12 @@ fmt:
 	$(GOFMT) -e -s -l -w $(ALL_SRC)
 	./scripts/updateLicenses.sh
 
+.PHONY: gas
+gas: install-gas
+	$(GAS) $(TOP_PKGS)
+
 .PHONY: lint
-lint:
+lint: gas
 	$(GOVET) $(TOP_PKGS)
 	@cat /dev/null > $(LINT_LOG)
 	@$(foreach pkg, $(TOP_PKGS), $(GOLINT) $(pkg) | grep -v -e pkg/es/wrapper.go -e /mocks/ -e thrift-gen -e thrift-0.9.2 >> $(LINT_LOG) || true;)
@@ -128,6 +133,10 @@ install-go-bindata:
 	go get github.com/jteeuwen/go-bindata/...
 	go get github.com/elazarl/go-bindata-assetfs/...
 
+.PHONY: install-gas
+install-gas:
+	go get github.com/GoASTScanner/gas/cmd/gas/...
+
 .PHONY: build-examples
 build-examples: install-go-bindata
 	(cd ./examples/hotrod/services/frontend/ && go-bindata-assetfs -pkg frontend web_assets/...)

cmd/query/app/static_handler.go

@@ -110,7 +110,7 @@ func loadUIConfig(uiConfig string) (map[string]interface{}, error) {
 		return nil, nil
 	}
 	ext := filepath.Ext(uiConfig)
-	bytes, err := ioutil.ReadFile(uiConfig)
+	bytes, err := ioutil.ReadFile(uiConfig) /* nolint #nosec , this comes from an admin, not user */
 	if err != nil {
 		return nil, errors.Wrapf(err, "Cannot read UI config file %v", uiConfig)
 	}

cmd/query/app/static_handler_test.go

@@ -118,7 +118,7 @@ func TestNewStaticAssetsHandlerErrors(t *testing.T) {
 
 	for _, base := range []string{"x", "x/", "/x/"} {
 		_, err := NewStaticAssetsHandler("fixture", StaticAssetsHandlerOptions{UIConfigPath: "fixture/ui-config.json", BasePath: base})
-		require.Error(t, err, "basePath=%s", base)
+		require.Errorf(t, err, "basePath=%s", base)
 		assert.Contains(t, err.Error(), "Invalid base path")
 	}
 }

model/json/model.go

@@ -14,11 +14,6 @@
 
 package json
 
-import (
-	"encoding/json"
-	"io/ioutil"
-)
-
 // ReferenceType is the reference type of one span to another
 type ReferenceType string
 
@@ -113,18 +108,3 @@ type DependencyLink struct {
 	Child     string `json:"child"`
 	CallCount uint64 `json:"callCount"`
 }
-
-// FromFile reads a Trace from a JSON file.
-// Mostly this exists to have some code aside from struct declaration,
-// as otherwise code coverate is reported as 0%.
-func FromFile(filename string) (*Trace, error) {
-	in, err := ioutil.ReadFile(filename)
-	if err != nil {
-		return nil, err
-	}
-	var trace Trace
-	if err := json.Unmarshal(in, &trace); err != nil {
-		return nil, err
-	}
-	return &trace, nil
-}

pkg/cassandra/gocql/testutils/udt.go

@@ -53,7 +53,7 @@ func (testCase UDTTestCase) Run(t *testing.T) {
 				proto: 0x03,
 				typ:   field.Type,
 			}
-			typeInfo := *(*gocql.NativeType)(unsafe.Pointer(&nt))
+			typeInfo := *(*gocql.NativeType)(unsafe.Pointer(&nt)) /* nolint #nosec */
 			data, err := testCase.Obj.MarshalUDT(field.Name, typeInfo)
 			if field.Err {
 				assert.Error(t, err)

plugin/sampling/strategystore/static/strategy_store.go

@@ -60,7 +60,7 @@ func loadStrategies(strategiesFile string) (*strategies, error) {
 	if strategiesFile == "" {
 		return nil, nil
 	}
-	bytes, err := ioutil.ReadFile(strategiesFile)
+	bytes, err := ioutil.ReadFile(strategiesFile) /* nolint #nosec , this comes from an admin, not user */
 	if err != nil {
 		return nil, errors.Wrap(err, "Failed to open strategies file")
 	}