$ git cherry --abbrev -v 8afd9cbb6cfb 66fb7fc33547 + 63b25c1 Fix typo in README (#235) + 419c929 G107 - SSRF (#236) + 145f1a0 Removed wrapping feature (#238) + ec32ce6 Support Go 1.11 (#239) + 762ff3a Allow quoted strings to be used to format SQL queries (#240) + 7f6509a Update README.md (#246) + 5f98926 Refactor Dockerfile (#245) + d3f1980 Fix false positives for SQL string concatenation with constants from another file (#247) + 64d58c2 Refactor the test code sample to support multiple files per sample + 1ecd47e bump Dockerfile golang from 1.10 to 1.11 + 027dc2b This fixes the html template when using '-fmt=html' - resolves HTML escaping issues within the template - resolves reference issues to reportInfo struct i.e. issues -> Issues, metrics -> Stats + 8c09a83 Add install.sh script + 97bc137 Add CI Installation steps and correct markdown lint errors + 3116b07 Fix typos in comments and rulelist (#256) + 443f84f Fix golint link (#263) + 4180994 Make G201 ignore CallExpr with no args (#262) + 9b966a4 add test case for strings.Builder G104 whitelist inclusion + adb4222 whitelist strings.Builder method in rule G104 + ae82798 Fix the WriteSring test by handling the error + 2695567 Build the code sample for string builder only fron Go 1.10 onwards + f14f17f Add a helper function which extracts the string parameters values of a call expression + 9b32fca Fix the bind rule to handle the case when the arguments of the net.Listen are returned by a function call + 24e3094 Extend the bind rule to handle the case when the net.Listen address in provided from a const + 72e95e8 Geneate and upload the test coverage report to codecove.io + 12400f9 Update README with the code coverage batch + 14ed63d Do not flag the unhandled errors which are explicitly ignored + f87af5f Detect the unhandled errors even though they are explicitly ignored if the 'audit: enabled' setting is defined in the global configuration (#274) + 5d33e6e Update the README with some details about the configuration file + b662615 Fix typo + a966ff7 Fix -conf example in README.md + 04ce7ba add a no-fail flag + e2752bc revert to default GOPATH if necessary (#279) - c04360f make API + 66fb7fc Replace import paths
		
			
				
	
	
		
			146 lines
		
	
	
		
			4.6 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
			
		
		
	
	
			146 lines
		
	
	
		
			4.6 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
// Copyright (c) 2015-2016 Dave Collins <dave@davec.name>
 | 
						|
//
 | 
						|
// Permission to use, copy, modify, and distribute this software for any
 | 
						|
// purpose with or without fee is hereby granted, provided that the above
 | 
						|
// copyright notice and this permission notice appear in all copies.
 | 
						|
//
 | 
						|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 | 
						|
// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 | 
						|
// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 | 
						|
// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 | 
						|
// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 | 
						|
// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 | 
						|
// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 | 
						|
 | 
						|
// NOTE: Due to the following build constraints, this file will only be compiled
 | 
						|
// when the code is not running on Google App Engine, compiled by GopherJS, and
 | 
						|
// "-tags safe" is not added to the go build command line.  The "disableunsafe"
 | 
						|
// tag is deprecated and thus should not be used.
 | 
						|
// Go versions prior to 1.4 are disabled because they use a different layout
 | 
						|
// for interfaces which make the implementation of unsafeReflectValue more complex.
 | 
						|
// +build !js,!appengine,!safe,!disableunsafe,go1.4
 | 
						|
 | 
						|
package spew
 | 
						|
 | 
						|
import (
 | 
						|
	"reflect"
 | 
						|
	"unsafe"
 | 
						|
)
 | 
						|
 | 
						|
const (
 | 
						|
	// UnsafeDisabled is a build-time constant which specifies whether or
 | 
						|
	// not access to the unsafe package is available.
 | 
						|
	UnsafeDisabled = false
 | 
						|
 | 
						|
	// ptrSize is the size of a pointer on the current arch.
 | 
						|
	ptrSize = unsafe.Sizeof((*byte)(nil))
 | 
						|
)
 | 
						|
 | 
						|
type flag uintptr
 | 
						|
 | 
						|
var (
 | 
						|
	// flagRO indicates whether the value field of a reflect.Value
 | 
						|
	// is read-only.
 | 
						|
	flagRO flag
 | 
						|
 | 
						|
	// flagAddr indicates whether the address of the reflect.Value's
 | 
						|
	// value may be taken.
 | 
						|
	flagAddr flag
 | 
						|
)
 | 
						|
 | 
						|
// flagKindMask holds the bits that make up the kind
 | 
						|
// part of the flags field. In all the supported versions,
 | 
						|
// it is in the lower 5 bits.
 | 
						|
const flagKindMask = flag(0x1f)
 | 
						|
 | 
						|
// Different versions of Go have used different
 | 
						|
// bit layouts for the flags type. This table
 | 
						|
// records the known combinations.
 | 
						|
var okFlags = []struct {
 | 
						|
	ro, addr flag
 | 
						|
}{{
 | 
						|
	// From Go 1.4 to 1.5
 | 
						|
	ro:   1 << 5,
 | 
						|
	addr: 1 << 7,
 | 
						|
}, {
 | 
						|
	// Up to Go tip.
 | 
						|
	ro:   1<<5 | 1<<6,
 | 
						|
	addr: 1 << 8,
 | 
						|
}}
 | 
						|
 | 
						|
var flagValOffset = func() uintptr {
 | 
						|
	field, ok := reflect.TypeOf(reflect.Value{}).FieldByName("flag")
 | 
						|
	if !ok {
 | 
						|
		panic("reflect.Value has no flag field")
 | 
						|
	}
 | 
						|
	return field.Offset
 | 
						|
}()
 | 
						|
 | 
						|
// flagField returns a pointer to the flag field of a reflect.Value.
 | 
						|
func flagField(v *reflect.Value) *flag {
 | 
						|
	return (*flag)(unsafe.Pointer(uintptr(unsafe.Pointer(v)) + flagValOffset))
 | 
						|
}
 | 
						|
 | 
						|
// unsafeReflectValue converts the passed reflect.Value into a one that bypasses
 | 
						|
// the typical safety restrictions preventing access to unaddressable and
 | 
						|
// unexported data.  It works by digging the raw pointer to the underlying
 | 
						|
// value out of the protected value and generating a new unprotected (unsafe)
 | 
						|
// reflect.Value to it.
 | 
						|
//
 | 
						|
// This allows us to check for implementations of the Stringer and error
 | 
						|
// interfaces to be used for pretty printing ordinarily unaddressable and
 | 
						|
// inaccessible values such as unexported struct fields.
 | 
						|
func unsafeReflectValue(v reflect.Value) reflect.Value {
 | 
						|
	if !v.IsValid() || (v.CanInterface() && v.CanAddr()) {
 | 
						|
		return v
 | 
						|
	}
 | 
						|
	flagFieldPtr := flagField(&v)
 | 
						|
	*flagFieldPtr &^= flagRO
 | 
						|
	*flagFieldPtr |= flagAddr
 | 
						|
	return v
 | 
						|
}
 | 
						|
 | 
						|
// Sanity checks against future reflect package changes
 | 
						|
// to the type or semantics of the Value.flag field.
 | 
						|
func init() {
 | 
						|
	field, ok := reflect.TypeOf(reflect.Value{}).FieldByName("flag")
 | 
						|
	if !ok {
 | 
						|
		panic("reflect.Value has no flag field")
 | 
						|
	}
 | 
						|
	if field.Type.Kind() != reflect.TypeOf(flag(0)).Kind() {
 | 
						|
		panic("reflect.Value flag field has changed kind")
 | 
						|
	}
 | 
						|
	type t0 int
 | 
						|
	var t struct {
 | 
						|
		A t0
 | 
						|
		// t0 will have flagEmbedRO set.
 | 
						|
		t0
 | 
						|
		// a will have flagStickyRO set
 | 
						|
		a t0
 | 
						|
	}
 | 
						|
	vA := reflect.ValueOf(t).FieldByName("A")
 | 
						|
	va := reflect.ValueOf(t).FieldByName("a")
 | 
						|
	vt0 := reflect.ValueOf(t).FieldByName("t0")
 | 
						|
 | 
						|
	// Infer flagRO from the difference between the flags
 | 
						|
	// for the (otherwise identical) fields in t.
 | 
						|
	flagPublic := *flagField(&vA)
 | 
						|
	flagWithRO := *flagField(&va) | *flagField(&vt0)
 | 
						|
	flagRO = flagPublic ^ flagWithRO
 | 
						|
 | 
						|
	// Infer flagAddr from the difference between a value
 | 
						|
	// taken from a pointer and not.
 | 
						|
	vPtrA := reflect.ValueOf(&t).Elem().FieldByName("A")
 | 
						|
	flagNoPtr := *flagField(&vA)
 | 
						|
	flagPtr := *flagField(&vPtrA)
 | 
						|
	flagAddr = flagNoPtr ^ flagPtr
 | 
						|
 | 
						|
	// Check that the inferred flags tally with one of the known versions.
 | 
						|
	for _, f := range okFlags {
 | 
						|
		if flagRO == f.ro && flagAddr == f.addr {
 | 
						|
			return
 | 
						|
		}
 | 
						|
	}
 | 
						|
	panic("reflect.Value read-only flag has changed semantics")
 | 
						|
}
 |