Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[pkg] fix deferring unsafe method "Close" on type "*os.File" #3548

Merged
merged 11 commits into from
Jul 20, 2022
Merged

[pkg] fix deferring unsafe method "Close" on type "*os.File" #3548

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
a2cf933
fix gosec error
huof6829 Jul 14, 2022
6e5b292
fix ioctl/doc gosec
huof6829 Jul 14, 2022
ed23cbc
Merge branch 'master' into fix_gosec_recovery
huof6829 Jul 18, 2022
7b5e8e7
move into defer
huof6829 Jul 18, 2022
5c265dd
move f.Close() into defer
huof6829 Jul 19, 2022
7907629
fix err return wrong
huof6829 Jul 19, 2022
aff96d2
Merge branch 'master' into fix_gosec_recovery
huof6829 Jul 19, 2022
9f9d573
Merge branch 'master' into fix_gosec_recovery
huof6829 Jul 19, 2022
85f6ba9
Merge branch 'master' into fix_gosec_recovery
raullenchai Jul 19, 2022
746ae35
Merge branch 'master' into fix_gosec_recovery
Liuhaai Jul 19, 2022
fd151a7
Merge branch 'master' into fix_gosec_recovery
Liuhaai Jul 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions ioctl/doc/doc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,19 +32,17 @@ func GenMarkdownTreeCustom(c *cobra.Command, dir string, name string, path strin
filename = filepath.Join(path, "README.md")
}

f, err := os.Create(filename)
f, err := os.Create(filepath.Clean(filename))
if err != nil {
return err
}
defer f.Close()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you check why security scan considers f.Close() as "unsafe method"? does it mean the error is not checked? like you need to:

defer func() {
    return f.Close()
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

error is skipped by defer f.Close(). it's unsafe. error should return.
defer func() error { return f.Close() }
or return f.Close() at the end of processing is both ok

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i see, so should check/catch the error inside defer

if return f.Close() at the end, also need to handle f.Close() in L42 and L45, so defer is better

Copy link
Member

@Liuhaai Liuhaai Jul 15, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

although current code is acceptable, you could find a new way to improve it

Copy link
Contributor Author

@huof6829 huof6829 Jul 18, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok. modified


if _, err := io.WriteString(f, filePrepender(filename)); err != nil {
return err
}
if err := GenMarkdownCustom(c, f, linkHandler); err != nil {
return err
}
return nil
return f.Close()
}

// GenMarkdownCustom creates custom markdown output.
Expand Down
8 changes: 6 additions & 2 deletions pkg/recovery/recovery.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,14 +79,18 @@ func LogCrash(r interface{}) {
}

func writeHeapProfile(path string) {
f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0644)
f, err := os.OpenFile(filepath.Clean(path), os.O_CREATE|os.O_RDWR, 0600)
if err != nil {
log.S().Errorf("crashlog: open heap profile error: %v", err)
return
}
defer f.Close()
if err := pprof.WriteHeapProfile(f); err != nil {
log.S().Errorf("crashlog: write heap profile error: %v", err)
return
}
if err = f.Close(); err != nil {
log.S().Errorf("crashlog: close heap profile error: %v", err)
return
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also move to defer

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

}
}

Expand Down