diff --git a/.semgrep/experimental/if-incorrect-nil-err-return.yaml b/.semgrep/experimental/if-incorrect-nil-err-return.yaml new file mode 100644 index 000000000..20b1533ba --- /dev/null +++ b/.semgrep/experimental/if-incorrect-nil-err-return.yaml @@ -0,0 +1,47 @@ +rules: + - id: if-incorrect-nil-err-return + languages: [go] + severity: WARNING + message: | + WARNING: A local variable '$ERR' is checked for nil, but a different variable is returned. + Ensure that the returned variable is the one that was checked or properly wrapped! + patterns: + - metavariable-regex: + metavariable: $ERR + regex: .*(?i)err # using .* to allow prefixes, because regex matching is left anchored. + + - pattern: | + if $ERR != nil { + ... + return ..., $OTHERERR + } + + - pattern-not: | + if $ERR != nil { + ... + return ..., $ERR + } + - pattern-not: | + if $ERR != nil { + ... + return ..., $ANYFUNC(..., $ERR, ...) + } + - pattern-not: | + if $ERR != nil { + ... + return ..., $ANYFUNC(..., $ANYFUNC1(..., $ERR, ...), ...) + } + - pattern-not: | + if $ERR != nil { + ... + $NEWERR := $ANYFUNC(..., $ERR, ...) + ... + return nil, $NEWERR + } + - pattern-not: | + if $ERR != nil { + ... + $NEWERR := $ANYFUNC(..., $ERR, ...) + ... + return ..., $ANYFUNC1(..., $NEWERR, ...) + }