Skip to content

Commit 2d4e985

Browse files
sampras343sampras343
authored
(docs): guard unsafe int/uint conversions flagged by gosec (#2679)
* (fix): gosec issues for integer overflow conversion Signed-off-by: Sachin Sampras M <sampras343@gmail.com> * (fix): gosec issues for integer overflow conversion in trillian client Signed-off-by: Sachin Sampras M <sampras343@gmail.com> * (fix): gosec high severity issues Signed-off-by: Sachin Sampras M <sampras343@gmail.com> * (docs): add relevant comments Signed-off-by: Sachin Sampras M <sampras343@gmail.com> * (docs): add nolint gosec comments Signed-off-by: Sachin Sampras M <sampras343@gmail.com> * (docs): lint whitespace fix Signed-off-by: Sachin Sampras M <sampras343@gmail.com> * (docs): added line wise no lint comments Signed-off-by: Sachin Sampras M <sampras343@gmail.com> --------- Signed-off-by: Sachin Sampras M <sampras343@gmail.com>
1 parent fdde6ec commit 2d4e985

File tree

6 files changed

+15
-15
lines changed

6 files changed

+15
-15
lines changed

‎pkg/api/api.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ func NewAPI(treeID int64) (*API, error) {
150150
if !ok {
151151
return nil, fmt.Errorf("no root found for inactive shard %d", r.TreeID)
152152
}
153-
cp, err := util.CreateAndSignCheckpoint(ctx, viper.GetString("rekor_server.hostname"), r.TreeID, uint64(r.TreeLength), root.RootHash, r.Signer)
153+
cp, err := util.CreateAndSignCheckpoint(ctx, viper.GetString("rekor_server.hostname"), r.TreeID, uint64(r.TreeLength), root.RootHash, r.Signer) //nolint:gosec
154154
if err != nil {
155155
return nil, fmt.Errorf("error signing checkpoint for inactive shard %d: %w", r.TreeID, err)
156156
}

‎pkg/api/entries.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ func logEntryFromLeaf(ctx context.Context, leaf *trillian.LogLeaf, signedLogRoot
127127
}
128128

129129
inclusionProof := models.InclusionProof{
130-
TreeSize: conv.Pointer(int64(root.TreeSize)),
130+
TreeSize: conv.Pointer(int64(root.TreeSize)), //nolint:gosec
131131
RootHash: conv.Pointer(hex.EncodeToString(root.RootHash)),
132132
LogIndex: conv.Pointer(proof.GetLeafIndex()),
133133
Hashes: hashes,
@@ -446,7 +446,7 @@ func createLogEntry(params entries.CreateLogEntryParams) (models.LogEntry, middl
446446
}
447447

448448
inclusionProof := models.InclusionProof{
449-
TreeSize: conv.Pointer(int64(root.TreeSize)),
449+
TreeSize: conv.Pointer(int64(root.TreeSize)), //nolint:gosec
450450
RootHash: conv.Pointer(hex.EncodeToString(root.RootHash)),
451451
LogIndex: conv.Pointer(queuedLeaf.LeafIndex),
452452
Hashes: hashes,

‎pkg/api/tlog.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ func GetLogInfoHandler(params tlog.GetLogInfoParams) middleware.Responder {
6565
}
6666

6767
hashString := hex.EncodeToString(root.RootHash)
68-
treeSize := int64(root.TreeSize)
68+
treeSize := int64(root.TreeSize) //nolint:gosec
6969

7070
scBytes, err := util.CreateAndSignCheckpoint(ctx,
7171
viper.GetString("rekor_server.hostname"), api.logRanges.GetActive().TreeID, root.TreeSize, root.RootHash, api.logRanges.GetActive().Signer)
@@ -164,7 +164,7 @@ func inactiveShardLogInfo(ctx context.Context, tid int64, cachedCheckpoints map[
164164
}
165165

166166
hashString := hex.EncodeToString(root.RootHash)
167-
treeSize := int64(root.TreeSize)
167+
treeSize := int64(root.TreeSize) //nolint:gosec
168168

169169
m := models.InactiveShardLogInfo{
170170
RootHash: &hashString,

‎pkg/sharding/ranges.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ func (l *LogRanges) CompleteInitialization(ctx context.Context, tcm *trilliancli
116116
if err := root.UnmarshalBinary(resp.GetLatestResult.SignedLogRoot.LogRoot); err != nil {
117117
return nil, err
118118
}
119-
l.inactive[i].TreeLength = int64(root.TreeSize)
119+
l.inactive[i].TreeLength = int64(root.TreeSize) //nolint:gosec
120120
sthMap[r.TreeID] = root
121121
}
122122
return sthMap, nil

‎pkg/trillianclient/trillian_client.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -240,11 +240,11 @@ func (t *TrillianClient) GetLeafAndProofByIndex(ctx context.Context, index int64
240240
&trillian.GetEntryAndProofRequest{
241241
LogId: t.logID,
242242
LeafIndex: index,
243-
TreeSize: int64(root.TreeSize),
243+
TreeSize: int64(root.TreeSize), //nolint:gosec
244244
})
245245

246246
if resp != nil && resp.Proof != nil {
247-
if err := proof.VerifyInclusion(rfc6962.DefaultHasher, uint64(index), root.TreeSize, resp.GetLeaf().MerkleLeafHash, resp.Proof.Hashes, root.RootHash); err != nil {
247+
if err := proof.VerifyInclusion(rfc6962.DefaultHasher, uint64(index), root.TreeSize, resp.GetLeaf().MerkleLeafHash, resp.Proof.Hashes, root.RootHash); err != nil { //nolint:gosec
248248
return &Response{
249249
Status: status.Code(err),
250250
Err: err,
@@ -324,7 +324,7 @@ func (t *TrillianClient) getProofByHash(ctx context.Context, hashValue []byte) *
324324
&trillian.GetInclusionProofByHashRequest{
325325
LogId: t.logID,
326326
LeafHash: hashValue,
327-
TreeSize: int64(root.TreeSize),
327+
TreeSize: int64(root.TreeSize), //nolint:gosec
328328
})
329329

330330
if resp != nil {

‎pkg/verify/verify.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -39,18 +39,18 @@ import (
3939
// and a second new STH. Callers MUST verify signature on the STHs'.
4040
func ProveConsistency(ctx context.Context, rClient *client.Rekor,
4141
oldSTH *util.SignedCheckpoint, newSTH *util.SignedCheckpoint, treeID string) error {
42-
oldTreeSize := int64(oldSTH.Size)
42+
oldTreeSize := int64(oldSTH.Size) // nolint: gosec
4343
switch {
4444
case oldTreeSize == 0:
4545
return errors.New("consistency proofs can not be computed starting from an empty log")
46-
case oldTreeSize == int64(newSTH.Size):
46+
case oldTreeSize == int64(newSTH.Size): // nolint: gosec
4747
if !bytes.Equal(oldSTH.Hash, newSTH.Hash) {
4848
return errors.New("old root hash does not match STH hash")
4949
}
50-
case oldTreeSize < int64(newSTH.Size):
50+
case oldTreeSize < int64(newSTH.Size): // nolint: gosec
5151
consistencyParams := tlog.NewGetLogProofParamsWithContext(ctx)
5252
consistencyParams.FirstSize = &oldTreeSize // Root size at the old, or trusted state.
53-
consistencyParams.LastSize = int64(newSTH.Size) // Root size at the new state to verify against.
53+
consistencyParams.LastSize = int64(newSTH.Size) // nolint: gosec // Root size at the new state to verify against.
5454
consistencyParams.TreeID = &treeID
5555
consistencyProof, err := rClient.Tlog.GetLogProof(consistencyParams)
5656
if err != nil {
@@ -68,7 +68,7 @@ func ProveConsistency(ctx context.Context, rClient *client.Rekor,
6868
oldSTH.Size, newSTH.Size, hashes, oldSTH.Hash, newSTH.Hash); err != nil {
6969
return err
7070
}
71-
case oldTreeSize > int64(newSTH.Size):
71+
case oldTreeSize > int64(newSTH.Size): // nolint: gosec
7272
return errors.New("inclusion proof returned a tree size larger than the verified tree size")
7373
}
7474
return nil
@@ -162,7 +162,7 @@ func VerifyInclusion(ctx context.Context, e *models.LogEntryAnon) error {
162162
leafHash := rfc6962.DefaultHasher.HashLeaf(entryBytes)
163163

164164
if err := proof.VerifyInclusion(rfc6962.DefaultHasher, uint64(*e.Verification.InclusionProof.LogIndex),
165-
uint64(*e.Verification.InclusionProof.TreeSize), leafHash, hashes, rootHash); err != nil {
165+
uint64(*e.Verification.InclusionProof.TreeSize), leafHash, hashes, rootHash); err != nil { // nolint: gosec
166166
return err
167167
}
168168

0 commit comments

Comments
 (0)