Merge pull request #298 from hypersign-protocol/add-gosec-git-workflow

Add gosec git workflow

.github/workflows/gosec.yml

@@ -0,0 +1,17 @@
+name: Gosec
+on:
+  pull_request:
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    env:
+      GO111MODULE: on
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v2
+
+      - name: Run Gosec Security Scanner
+        uses: cosmos/gosec@master
+        with:
+          args: -exclude=G705 ./...

app/app.go

@@ -83,7 +83,6 @@ import (
 	ibcclientclient "github.com/cosmos/ibc-go/v4/modules/core/02-client/client"
 	ibcclienttypes "github.com/cosmos/ibc-go/v4/modules/core/02-client/types"
 	ibcporttypes "github.com/cosmos/ibc-go/v4/modules/core/05-port/types"
-	porttypes "github.com/cosmos/ibc-go/v4/modules/core/05-port/types"
 	ibchost "github.com/cosmos/ibc-go/v4/modules/core/24-host"
 	ibckeeper "github.com/cosmos/ibc-go/v4/modules/core/keeper"
 
@@ -476,7 +475,7 @@ func NewHidnodeApp(
 	transferModule := transfer.NewAppModule(app.TransferKeeper)
 
 	// Create Transfer Stack
-	var transferStack porttypes.IBCModule
+	var transferStack ibcporttypes.IBCModule
 	transferStack = transfer.NewIBCModule(app.TransferKeeper)
 	transferStack = ibcfee.NewIBCMiddleware(transferStack, app.IBCFeeKeeper)
 
@@ -533,7 +532,7 @@ func NewHidnodeApp(
 	)
 
 	// Create fee enabled wasm ibc Stack
-	var wasmStack porttypes.IBCModule
+	var wasmStack ibcporttypes.IBCModule
 	wasmStack = wasm.NewIBCHandler(app.WasmKeeper, app.IBCKeeper.ChannelKeeper, app.IBCFeeKeeper)
 	wasmStack = ibcfee.NewIBCMiddleware(wasmStack, app.IBCFeeKeeper)
 

app/export.go

@@ -150,6 +150,8 @@ func (app *HidnodeApp) prepForZeroHeightGenesis(ctx sdk.Context, jailAllowedAddr
 	iter := sdk.KVStoreReversePrefixIterator(store, stakingtypes.ValidatorsKey)
 	counter := int16(0)
 
+	defer iter.Close()
+
 	for ; iter.Valid(); iter.Next() {
 		addr := sdk.ValAddress(iter.Key()[1:])
 		validator, found := app.StakingKeeper.GetValidator(ctx, addr)
@@ -166,8 +168,6 @@ func (app *HidnodeApp) prepForZeroHeightGenesis(ctx sdk.Context, jailAllowedAddr
 		counter++
 	}
 
-	iter.Close()
-
 	if _, err := app.StakingKeeper.ApplyAndReturnValidatorSetUpdates(ctx); err != nil {
 		panic(err)
 	}

cmd/hid-noded/cmd/debug_extensions.go

@@ -2,7 +2,7 @@ package cmd
 
 import (
 	"crypto/ed25519"
-	"crypto/rand"
+	"crypto/rand" /* #nosec G702 */
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/hex"

x/ssi/ante/decorators.go

@@ -63,7 +63,7 @@ func (mfd MempoolFeeDecorator) AnteHandle(ctx sdk.Context, tx sdk.Tx, simulate b
 
 			// Determine the required fees by multiplying each required minimum gas
 			// price by the gas limit, where fee = ceil(minGasPrice * gasLimit).
-			glDec := sdk.NewDec(int64(gas))
+			glDec := sdk.NewDec(int64(gas)) /* #nosec G701 */
 			for i, gp := range minGasPrices {
 				fee := gp.Amount.Mul(glDec)
 				requiredFees[i] = sdk.NewCoin(gp.Denom, fee.Ceil().RoundInt())

x/ssi/keeper/msg_server_create_credential.go

@@ -54,7 +54,10 @@ func (k msgServer) RegisterCredentialStatus(goCtx context.Context, msg *types.Ms
 	}
 
 	// Check if the created date before issuance date
-	currentDate, _ := time.Parse(time.RFC3339, msgCredProof.Created)
+	currentDate, err := time.Parse(time.RFC3339, msgCredProof.Created)
+	if err != nil {
+		return nil, err
+	}
 	if currentDate.Before(issuanceDateParsed) {
 		return nil, sdkerrors.Wrapf(types.ErrInvalidDate, "proof attached has a creation date before issuance date")
 	}

x/ssi/keeper/msg_server_update_credential.go

@@ -3,7 +3,7 @@ package keeper
 import (
 	"context"
 	"fmt"
-	"reflect"
+	"reflect" /* #nosec G702 */
 	"time"
 
 	sdk "github.com/cosmos/cosmos-sdk/types"
@@ -89,7 +89,10 @@ func (k msgServer) UpdateCredentialStatus(goCtx context.Context, msg *types.MsgU
 	}
 
 	// Check if the created date before issuance date
-	currentDate, _ := time.Parse(time.RFC3339, msgNewCredProof.Created)
+	currentDate, err := time.Parse(time.RFC3339, msgNewCredProof.Created)
+	if err != nil {
+		return nil, err
+	}
 	if currentDate.Before(newIssuanceDateParsed) {
 		return nil, sdkerrors.Wrapf(types.ErrInvalidDate, "proof attached has a creation date before issuance date")
 	}

x/ssi/keeper/msg_server_update_did.go

@@ -3,7 +3,7 @@ package keeper
 import (
 	"context"
 	"fmt"
-	"reflect"
+	"reflect" /* #nosec G702 */
 
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"

x/ssi/ld-context/normalize.go

@@ -106,7 +106,7 @@ func normalize(jsonLdDocument JsonLdDocument, algorithm string) (string, error)
 }
 
 // Convert JsonLdDid to interface
-func jsonLdDocToInterface(jsonLd any) interface{} {
+func jsonLdDocToInterface(jsonLd interface{}) interface{} {
 	var intf interface{}
 
 	jsonLdBytes, err := json.Marshal(jsonLd)

x/ssi/types/genesis.go

@@ -18,7 +18,10 @@ func DefaultGenesis() *GenesisState {
 func (gs GenesisState) Validate() error {
 	namespace := gs.ChainNamespace
 
-	regexPattern, _ := regexp.Compile("^[a-zA-Z0-9-]*$") // Matches string containing whitespaces and tabs
+	regexPattern, err := regexp.Compile("^[a-zA-Z0-9-]*$") // Matches string containing whitespaces and tabs
+	if err != nil {
+		return err
+	}
 	maxChainNamespaceLength := 10
 
 	if len(namespace) > maxChainNamespaceLength {

x/ssi/types/utils.go

@@ -8,7 +8,9 @@ import (
 // GetDidFromDidUrl returns didId from didURL.
 // TODO: need to handle query and path
 func GetElementsFromDidUrl(didUrl string) (string, string) {
-	didId, fragment, _ := strings.Cut(didUrl, "#")
+	didElements := strings.Split(didUrl, "#")
+	didId := didElements[0]
+	fragment := didElements[1]
 	return didId, fragment
 }