Add self-contained gometalinter build tooling.

tools/vendor/github.com/GoASTScanner/gas/rules/big.go

@@ -0,0 +1,44 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	gas "github.com/GoASTScanner/gas/core"
+	"go/ast"
+)
+
+type UsingBigExp struct {
+	gas.MetaData
+	pkg   string
+	calls []string
+}
+
+func (r *UsingBigExp) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if _, matched := gas.MatchCallByType(n, c, r.pkg, r.calls...); matched {
+		return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+	}
+	return nil, nil
+}
+func NewUsingBigExp(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &UsingBigExp{
+		pkg:   "*math/big.Int",
+		calls: []string{"Exp"},
+		MetaData: gas.MetaData{
+			What:       "Use of math/big.Int.Exp function should be audited for modulus == 0",
+			Severity:   gas.Low,
+			Confidence: gas.High,
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/bind.go

@@ -0,0 +1,52 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+// Looks for net.Listen("0.0.0.0") or net.Listen(":8080")
+type BindsToAllNetworkInterfaces struct {
+	gas.MetaData
+	call    *regexp.Regexp
+	pattern *regexp.Regexp
+}
+
+func (r *BindsToAllNetworkInterfaces) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node := gas.MatchCall(n, r.call); node != nil {
+		if arg, err := gas.GetString(node.Args[1]); err == nil {
+			if r.pattern.MatchString(arg) {
+				return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+			}
+		}
+	}
+	return
+}
+
+func NewBindsToAllNetworkInterfaces(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BindsToAllNetworkInterfaces{
+		call:    regexp.MustCompile(`^(net|tls)\.Listen$`),
+		pattern: regexp.MustCompile(`^(0.0.0.0|:).*$`),
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       "Binds to all network interfaces",
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/blacklist.go

@@ -0,0 +1,79 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type BlacklistImport struct {
+	gas.MetaData
+	Path string
+}
+
+func (r *BlacklistImport) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node, ok := n.(*ast.ImportSpec); ok {
+		if r.Path == node.Path.Value && node.Name.String() != "_" {
+			return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+func NewBlacklist_crypto_md5(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BlacklistImport{
+		MetaData: gas.MetaData{
+			Severity:   gas.High,
+			Confidence: gas.High,
+			What:       "Use of weak cryptographic primitive",
+		},
+		Path: `"crypto/md5"`,
+	}, []ast.Node{(*ast.ImportSpec)(nil)}
+}
+
+func NewBlacklist_crypto_des(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BlacklistImport{
+		MetaData: gas.MetaData{
+			Severity:   gas.High,
+			Confidence: gas.High,
+			What:       "Use of weak cryptographic primitive",
+		},
+		Path: `"crypto/des"`,
+	}, []ast.Node{(*ast.ImportSpec)(nil)}
+}
+
+func NewBlacklist_crypto_rc4(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BlacklistImport{
+		MetaData: gas.MetaData{
+			Severity:   gas.High,
+			Confidence: gas.High,
+			What:       "Use of weak cryptographic primitive",
+		},
+		Path: `"crypto/rc4"`,
+	}, []ast.Node{(*ast.ImportSpec)(nil)}
+}
+
+func NewBlacklist_net_http_cgi(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BlacklistImport{
+		MetaData: gas.MetaData{
+			Severity:   gas.High,
+			Confidence: gas.High,
+			What:       "Go versions < 1.6.3 are vulnerable to Httpoxy attack: (CVE-2016-5386)",
+		},
+		Path: `"net/http/cgi"`,
+	}, []ast.Node{(*ast.ImportSpec)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/errors.go

@@ -0,0 +1,96 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	gas "github.com/GoASTScanner/gas/core"
+	"go/ast"
+	"go/types"
+)
+
+type NoErrorCheck struct {
+	gas.MetaData
+	whitelist gas.CallList
+}
+
+func returnsError(callExpr *ast.CallExpr, ctx *gas.Context) int {
+	if tv := ctx.Info.TypeOf(callExpr); tv != nil {
+		switch t := tv.(type) {
+		case *types.Tuple:
+			for pos := 0; pos < t.Len(); pos += 1 {
+				variable := t.At(pos)
+				if variable != nil && variable.Type().String() == "error" {
+					return pos
+				}
+			}
+		case *types.Named:
+			if t.String() == "error" {
+				return 0
+			}
+		}
+	}
+	return -1
+}
+
+func (r *NoErrorCheck) Match(n ast.Node, ctx *gas.Context) (*gas.Issue, error) {
+	switch stmt := n.(type) {
+	case *ast.AssignStmt:
+		for _, expr := range stmt.Rhs {
+			if callExpr, ok := expr.(*ast.CallExpr); ok && !r.whitelist.ContainsCallExpr(callExpr, ctx) {
+				pos := returnsError(callExpr, ctx)
+				if pos < 0 || pos >= len(stmt.Lhs) {
+					return nil, nil
+				}
+				if id, ok := stmt.Lhs[pos].(*ast.Ident); ok && id.Name == "_" {
+					return gas.NewIssue(ctx, n, r.What, r.Severity, r.Confidence), nil
+				}
+			}
+		}
+	case *ast.ExprStmt:
+		if callExpr, ok := stmt.X.(*ast.CallExpr); ok && !r.whitelist.ContainsCallExpr(callExpr, ctx) {
+			pos := returnsError(callExpr, ctx)
+			if pos >= 0 {
+				return gas.NewIssue(ctx, n, r.What, r.Severity, r.Confidence), nil
+			}
+		}
+	}
+	return nil, nil
+}
+
+func NewNoErrorCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+
+	// TODO(gm) Come up with sensible defaults here. Or flip it to use a
+	// black list instead.
+	whitelist := gas.NewCallList()
+	whitelist.AddAll("bytes.Buffer", "Write", "WriteByte", "WriteRune", "WriteString")
+	whitelist.AddAll("fmt", "Print", "Printf", "Println")
+	whitelist.Add("io.PipeWriter", "CloseWithError")
+
+	if configured, ok := conf["G104"]; ok {
+		if whitelisted, ok := configured.(map[string][]string); ok {
+			for key, val := range whitelisted {
+				whitelist.AddAll(key, val...)
+			}
+		}
+	}
+	return &NoErrorCheck{
+		MetaData: gas.MetaData{
+			Severity:   gas.Low,
+			Confidence: gas.High,
+			What:       "Errors unhandled.",
+		},
+		whitelist: whitelist,
+	}, []ast.Node{(*ast.AssignStmt)(nil), (*ast.ExprStmt)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/fileperms.go

@@ -0,0 +1,85 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"fmt"
+	"go/ast"
+	"strconv"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type FilePermissions struct {
+	gas.MetaData
+	mode  int64
+	pkg   string
+	calls []string
+}
+
+func getConfiguredMode(conf map[string]interface{}, configKey string, defaultMode int64) int64 {
+	var mode int64 = defaultMode
+	if value, ok := conf[configKey]; ok {
+		switch value.(type) {
+		case int64:
+			mode = value.(int64)
+		case string:
+			if m, e := strconv.ParseInt(value.(string), 0, 64); e != nil {
+				mode = defaultMode
+			} else {
+				mode = m
+			}
+		}
+	}
+	return mode
+}
+
+func (r *FilePermissions) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+	if callexpr, matched := gas.MatchCallByPackage(n, c, r.pkg, r.calls...); matched {
+		modeArg := callexpr.Args[len(callexpr.Args)-1]
+		if mode, err := gas.GetInt(modeArg); err == nil && mode > r.mode {
+			return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+func NewFilePerms(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	mode := getConfiguredMode(conf, "G302", 0600)
+	return &FilePermissions{
+		mode:  mode,
+		pkg:   "os",
+		calls: []string{"OpenFile", "Chmod"},
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       fmt.Sprintf("Expect file permissions to be %#o or less", mode),
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}
+
+func NewMkdirPerms(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	mode := getConfiguredMode(conf, "G301", 0700)
+	return &FilePermissions{
+		mode:  mode,
+		pkg:   "os",
+		calls: []string{"Mkdir", "MkdirAll"},
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       fmt.Sprintf("Expect directory permissions to be %#o or less", mode),
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/hardcoded_credentials.go

@@ -0,0 +1,148 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	gas "github.com/GoASTScanner/gas/core"
+	"go/ast"
+	"go/token"
+	"regexp"
+
+	"github.com/nbutton23/zxcvbn-go"
+	"strconv"
+)
+
+type Credentials struct {
+	gas.MetaData
+	pattern          *regexp.Regexp
+	entropyThreshold float64
+	perCharThreshold float64
+	truncate         int
+	ignoreEntropy    bool
+}
+
+func truncate(s string, n int) string {
+	if n > len(s) {
+		return s
+	}
+	return s[:n]
+}
+
+func (r *Credentials) isHighEntropyString(str string) bool {
+	s := truncate(str, r.truncate)
+	info := zxcvbn.PasswordStrength(s, []string{})
+	entropyPerChar := info.Entropy / float64(len(s))
+	return (info.Entropy >= r.entropyThreshold ||
+		(info.Entropy >= (r.entropyThreshold/2) &&
+			entropyPerChar >= r.perCharThreshold))
+}
+
+func (r *Credentials) Match(n ast.Node, ctx *gas.Context) (*gas.Issue, error) {
+	switch node := n.(type) {
+	case *ast.AssignStmt:
+		return r.matchAssign(node, ctx)
+	case *ast.GenDecl:
+		return r.matchGenDecl(node, ctx)
+	}
+	return nil, nil
+}
+
+func (r *Credentials) matchAssign(assign *ast.AssignStmt, ctx *gas.Context) (*gas.Issue, error) {
+	for _, i := range assign.Lhs {
+		if ident, ok := i.(*ast.Ident); ok {
+			if r.pattern.MatchString(ident.Name) {
+				for _, e := range assign.Rhs {
+					if val, err := gas.GetString(e); err == nil {
+						if r.ignoreEntropy || (!r.ignoreEntropy && r.isHighEntropyString(val)) {
+							return gas.NewIssue(ctx, assign, r.What, r.Severity, r.Confidence), nil
+						}
+					}
+				}
+			}
+		}
+	}
+	return nil, nil
+}
+
+func (r *Credentials) matchGenDecl(decl *ast.GenDecl, ctx *gas.Context) (*gas.Issue, error) {
+	if decl.Tok != token.CONST && decl.Tok != token.VAR {
+		return nil, nil
+	}
+	for _, spec := range decl.Specs {
+		if valueSpec, ok := spec.(*ast.ValueSpec); ok {
+			for index, ident := range valueSpec.Names {
+				if r.pattern.MatchString(ident.Name) && valueSpec.Values != nil {
+					// const foo, bar = "same value"
+					if len(valueSpec.Values) <= index {
+						index = len(valueSpec.Values) - 1
+					}
+					if val, err := gas.GetString(valueSpec.Values[index]); err == nil {
+						if r.ignoreEntropy || (!r.ignoreEntropy && r.isHighEntropyString(val)) {
+							return gas.NewIssue(ctx, valueSpec, r.What, r.Severity, r.Confidence), nil
+						}
+					}
+				}
+			}
+		}
+	}
+	return nil, nil
+}
+
+func NewHardcodedCredentials(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	pattern := `(?i)passwd|pass|password|pwd|secret|token`
+	entropyThreshold := 80.0
+	perCharThreshold := 3.0
+	ignoreEntropy := false
+	var truncateString int = 16
+	if val, ok := conf["G101"]; ok {
+		conf := val.(map[string]string)
+		if configPattern, ok := conf["pattern"]; ok {
+			pattern = configPattern
+		}
+		if configIgnoreEntropy, ok := conf["ignore_entropy"]; ok {
+			if parsedBool, err := strconv.ParseBool(configIgnoreEntropy); err == nil {
+				ignoreEntropy = parsedBool
+			}
+		}
+		if configEntropyThreshold, ok := conf["entropy_threshold"]; ok {
+			if parsedNum, err := strconv.ParseFloat(configEntropyThreshold, 64); err == nil {
+				entropyThreshold = parsedNum
+			}
+		}
+		if configCharThreshold, ok := conf["per_char_threshold"]; ok {
+			if parsedNum, err := strconv.ParseFloat(configCharThreshold, 64); err == nil {
+				perCharThreshold = parsedNum
+			}
+		}
+		if configTruncate, ok := conf["truncate"]; ok {
+			if parsedInt, err := strconv.Atoi(configTruncate); err == nil {
+				truncateString = parsedInt
+			}
+		}
+	}
+
+	return &Credentials{
+		pattern:          regexp.MustCompile(pattern),
+		entropyThreshold: entropyThreshold,
+		perCharThreshold: perCharThreshold,
+		ignoreEntropy:    ignoreEntropy,
+		truncate:         truncateString,
+		MetaData: gas.MetaData{
+			What:       "Potential hardcoded credentials",
+			Confidence: gas.Low,
+			Severity:   gas.High,
+		},
+	}, []ast.Node{(*ast.AssignStmt)(nil), (*ast.GenDecl)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/rand.go

@@ -0,0 +1,49 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type WeakRand struct {
+	gas.MetaData
+	funcNames   []string
+	packagePath string
+}
+
+func (w *WeakRand) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+	for _, funcName := range w.funcNames {
+		if _, matched := gas.MatchCallByPackage(n, c, w.packagePath, funcName); matched {
+			return gas.NewIssue(c, n, w.What, w.Severity, w.Confidence), nil
+		}
+	}
+
+	return nil, nil
+}
+
+func NewWeakRandCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &WeakRand{
+		funcNames:   []string{"Read", "Int"},
+		packagePath: "math/rand",
+		MetaData: gas.MetaData{
+			Severity:   gas.High,
+			Confidence: gas.Medium,
+			What:       "Use of weak random number generator (math/rand instead of crypto/rand)",
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/rsa.go

@@ -0,0 +1,51 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"fmt"
+	"go/ast"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type WeakKeyStrength struct {
+	gas.MetaData
+	pattern *regexp.Regexp
+	bits    int
+}
+
+func (w *WeakKeyStrength) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+	if node := gas.MatchCall(n, w.pattern); node != nil {
+		if bits, err := gas.GetInt(node.Args[1]); err == nil && bits < (int64)(w.bits) {
+			return gas.NewIssue(c, n, w.What, w.Severity, w.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+func NewWeakKeyStrength(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	bits := 2048
+	return &WeakKeyStrength{
+		pattern: regexp.MustCompile(`^rsa\.GenerateKey$`),
+		bits:    bits,
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       fmt.Sprintf("RSA keys should be at least %d bits", bits),
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/sql.go

@@ -0,0 +1,99 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type SqlStatement struct {
+	gas.MetaData
+	pattern *regexp.Regexp
+}
+
+type SqlStrConcat struct {
+	SqlStatement
+}
+
+// see if we can figure out what it is
+func (s *SqlStrConcat) checkObject(n *ast.Ident) bool {
+	if n.Obj != nil {
+		return n.Obj.Kind != ast.Var && n.Obj.Kind != ast.Fun
+	}
+	return false
+}
+
+// Look for "SELECT * FROM table WHERE " + " ' OR 1=1"
+func (s *SqlStrConcat) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+	if node, ok := n.(*ast.BinaryExpr); ok {
+		if start, ok := node.X.(*ast.BasicLit); ok {
+			if str, e := gas.GetString(start); s.pattern.MatchString(str) && e == nil {
+				if _, ok := node.Y.(*ast.BasicLit); ok {
+					return nil, nil // string cat OK
+				}
+				if second, ok := node.Y.(*ast.Ident); ok && s.checkObject(second) {
+					return nil, nil
+				}
+				return gas.NewIssue(c, n, s.What, s.Severity, s.Confidence), nil
+			}
+		}
+	}
+	return nil, nil
+}
+
+func NewSqlStrConcat(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &SqlStrConcat{
+		SqlStatement: SqlStatement{
+			pattern: regexp.MustCompile(`(?)(SELECT|DELETE|INSERT|UPDATE|INTO|FROM|WHERE) `),
+			MetaData: gas.MetaData{
+				Severity:   gas.Medium,
+				Confidence: gas.High,
+				What:       "SQL string concatenation",
+			},
+		},
+	}, []ast.Node{(*ast.BinaryExpr)(nil)}
+}
+
+type SqlStrFormat struct {
+	SqlStatement
+	call *regexp.Regexp
+}
+
+// Looks for "fmt.Sprintf("SELECT * FROM foo where '%s', userInput)"
+func (s *SqlStrFormat) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node := gas.MatchCall(n, s.call); node != nil {
+		if arg, e := gas.GetString(node.Args[0]); s.pattern.MatchString(arg) && e == nil {
+			return gas.NewIssue(c, n, s.What, s.Severity, s.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+func NewSqlStrFormat(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &SqlStrFormat{
+		call: regexp.MustCompile(`^fmt\.Sprintf$`),
+		SqlStatement: SqlStatement{
+			pattern: regexp.MustCompile("(?)(SELECT|DELETE|INSERT|UPDATE|INTO|FROM|WHERE) "),
+			MetaData: gas.MetaData{
+				Severity:   gas.Medium,
+				Confidence: gas.High,
+				What:       "SQL string formatting",
+			},
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/subproc.go

@@ -0,0 +1,56 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+	"regexp"
+	"strings"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type Subprocess struct {
+	pattern *regexp.Regexp
+}
+
+func (r *Subprocess) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+	if node := gas.MatchCall(n, r.pattern); node != nil {
+		for _, arg := range node.Args {
+			if !gas.TryResolve(arg, c) {
+				what := "Subprocess launching with variable."
+				return gas.NewIssue(c, n, what, gas.High, gas.High), nil
+			}
+		}
+
+		// call with partially qualified command
+		if str, err := gas.GetString(node.Args[0]); err == nil {
+			if !strings.HasPrefix(str, "/") {
+				what := "Subprocess launching with partial path."
+				return gas.NewIssue(c, n, what, gas.Medium, gas.High), nil
+			}
+		}
+
+		what := "Subprocess launching should be audited."
+		return gas.NewIssue(c, n, what, gas.Low, gas.High), nil
+	}
+	return nil, nil
+}
+
+func NewSubproc(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &Subprocess{
+		pattern: regexp.MustCompile(`^exec\.Command|syscall\.Exec$`),
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/tempfiles.go

@@ -0,0 +1,49 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type BadTempFile struct {
+	gas.MetaData
+	args *regexp.Regexp
+	call *regexp.Regexp
+}
+
+func (t *BadTempFile) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node := gas.MatchCall(n, t.call); node != nil {
+		if arg, e := gas.GetString(node.Args[0]); t.args.MatchString(arg) && e == nil {
+			return gas.NewIssue(c, n, t.What, t.Severity, t.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+func NewBadTempFile(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BadTempFile{
+		call: regexp.MustCompile(`ioutil\.WriteFile|os\.Create`),
+		args: regexp.MustCompile(`^/tmp/.*$|^/var/tmp/.*$`),
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       "File creation in shared tmp directory without using ioutil.Tempfile",
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/templates.go

@@ -0,0 +1,49 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type TemplateCheck struct {
+	gas.MetaData
+	call *regexp.Regexp
+}
+
+func (t *TemplateCheck) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node := gas.MatchCall(n, t.call); node != nil {
+		for _, arg := range node.Args {
+			if _, ok := arg.(*ast.BasicLit); !ok { // basic lits are safe
+				return gas.NewIssue(c, n, t.What, t.Severity, t.Confidence), nil
+			}
+		}
+	}
+	return nil, nil
+}
+
+func NewTemplateCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &TemplateCheck{
+		call: regexp.MustCompile(`^template\.(HTML|JS|URL)$`),
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.Low,
+			What:       "this method will not auto-escape HTML. Verify data is well formed.",
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/tls.go

@@ -0,0 +1,191 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"fmt"
+	"go/ast"
+	"reflect"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type InsecureConfigTLS struct {
+	MinVersion  int16
+	MaxVersion  int16
+	pattern     *regexp.Regexp
+	goodCiphers []string
+}
+
+func stringInSlice(a string, list []string) bool {
+	for _, b := range list {
+		if b == a {
+			return true
+		}
+	}
+	return false
+}
+
+func (t *InsecureConfigTLS) processTlsCipherSuites(n ast.Node, c *gas.Context) *gas.Issue {
+	a := reflect.TypeOf(&ast.KeyValueExpr{})
+	b := reflect.TypeOf(&ast.CompositeLit{})
+	if node, ok := gas.SimpleSelect(n, a, b).(*ast.CompositeLit); ok {
+		for _, elt := range node.Elts {
+			if ident, ok := elt.(*ast.SelectorExpr); ok {
+				if !stringInSlice(ident.Sel.Name, t.goodCiphers) {
+					str := fmt.Sprintf("TLS Bad Cipher Suite: %s", ident.Sel.Name)
+					return gas.NewIssue(c, n, str, gas.High, gas.High)
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func (t *InsecureConfigTLS) processTlsConfVal(n *ast.KeyValueExpr, c *gas.Context) *gas.Issue {
+	if ident, ok := n.Key.(*ast.Ident); ok {
+		switch ident.Name {
+		case "InsecureSkipVerify":
+			if node, ok := n.Value.(*ast.Ident); ok {
+				if node.Name != "false" {
+					return gas.NewIssue(c, n, "TLS InsecureSkipVerify set true.", gas.High, gas.High)
+				}
+			} else {
+				// TODO(tk): symbol tab look up to get the actual value
+				return gas.NewIssue(c, n, "TLS InsecureSkipVerify may be true.", gas.High, gas.Low)
+			}
+
+		case "PreferServerCipherSuites":
+			if node, ok := n.Value.(*ast.Ident); ok {
+				if node.Name == "false" {
+					return gas.NewIssue(c, n, "TLS PreferServerCipherSuites set false.", gas.Medium, gas.High)
+				}
+			} else {
+				// TODO(tk): symbol tab look up to get the actual value
+				return gas.NewIssue(c, n, "TLS PreferServerCipherSuites may be false.", gas.Medium, gas.Low)
+			}
+
+		case "MinVersion":
+			if ival, ierr := gas.GetInt(n.Value); ierr == nil {
+				if (int16)(ival) < t.MinVersion {
+					return gas.NewIssue(c, n, "TLS MinVersion too low.", gas.High, gas.High)
+				}
+				// TODO(tk): symbol tab look up to get the actual value
+				return gas.NewIssue(c, n, "TLS MinVersion may be too low.", gas.High, gas.Low)
+			}
+
+		case "MaxVersion":
+			if ival, ierr := gas.GetInt(n.Value); ierr == nil {
+				if (int16)(ival) < t.MaxVersion {
+					return gas.NewIssue(c, n, "TLS MaxVersion too low.", gas.High, gas.High)
+				}
+				// TODO(tk): symbol tab look up to get the actual value
+				return gas.NewIssue(c, n, "TLS MaxVersion may be too low.", gas.High, gas.Low)
+			}
+
+		case "CipherSuites":
+			if ret := t.processTlsCipherSuites(n, c); ret != nil {
+				return ret
+			}
+
+		}
+
+	}
+	return nil
+}
+
+func (t *InsecureConfigTLS) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node := gas.MatchCompLit(n, t.pattern); node != nil {
+		for _, elt := range node.Elts {
+			if kve, ok := elt.(*ast.KeyValueExpr); ok {
+				gi = t.processTlsConfVal(kve, c)
+				if gi != nil {
+					break
+				}
+			}
+		}
+	}
+	return
+}
+
+func NewModernTlsCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	// https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
+	return &InsecureConfigTLS{
+		pattern:    regexp.MustCompile(`^tls\.Config$`),
+		MinVersion: 0x0303, // TLS 1.2 only
+		MaxVersion: 0x0303,
+		goodCiphers: []string{
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+			"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+		},
+	}, []ast.Node{(*ast.CompositeLit)(nil)}
+}
+
+func NewIntermediateTlsCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	// https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29
+	return &InsecureConfigTLS{
+		pattern:    regexp.MustCompile(`^tls\.Config$`),
+		MinVersion: 0x0301, // TLS 1.2, 1.1, 1.0
+		MaxVersion: 0x0303,
+		goodCiphers: []string{
+			"TLS_RSA_WITH_AES_128_CBC_SHA",
+			"TLS_RSA_WITH_AES_256_CBC_SHA",
+			"TLS_RSA_WITH_AES_128_GCM_SHA256",
+			"TLS_RSA_WITH_AES_256_GCM_SHA384",
+			"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
+			"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_RC4_128_SHA",
+			"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+			"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+		},
+	}, []ast.Node{(*ast.CompositeLit)(nil)}
+}
+
+func NewCompatTlsCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	// https://wiki.mozilla.org/Security/Server_Side_TLS#Old_compatibility_.28default.29
+	return &InsecureConfigTLS{
+		pattern:    regexp.MustCompile(`^tls\.Config$`),
+		MinVersion: 0x0301, // TLS 1.2, 1.1, 1.0
+		MaxVersion: 0x0303,
+		goodCiphers: []string{
+			"TLS_RSA_WITH_RC4_128_SHA",
+			"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+			"TLS_RSA_WITH_AES_128_CBC_SHA",
+			"TLS_RSA_WITH_AES_256_CBC_SHA",
+			"TLS_RSA_WITH_AES_128_GCM_SHA256",
+			"TLS_RSA_WITH_AES_256_GCM_SHA384",
+			"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
+			"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_RC4_128_SHA",
+			"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+			"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+		},
+	}, []ast.Node{(*ast.CompositeLit)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/unsafe.go

@@ -0,0 +1,45 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	gas "github.com/GoASTScanner/gas/core"
+	"go/ast"
+)
+
+type UsingUnsafe struct {
+	gas.MetaData
+	pkg   string
+	calls []string
+}
+
+func (r *UsingUnsafe) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if _, matches := gas.MatchCallByPackage(n, c, r.pkg, r.calls...); matches {
+		return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+	}
+	return nil, nil
+}
+
+func NewUsingUnsafe(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &UsingUnsafe{
+		pkg:   "unsafe",
+		calls: []string{"Alignof", "Offsetof", "Sizeof", "Pointer"},
+		MetaData: gas.MetaData{
+			What:       "Use of unsafe calls should be audited",
+			Severity:   gas.Low,
+			Confidence: gas.High,
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/weakcrypto.go

@@ -0,0 +1,53 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type UsesWeakCryptography struct {
+	gas.MetaData
+	blacklist map[string][]string
+}
+
+func (r *UsesWeakCryptography) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+
+	for pkg, funcs := range r.blacklist {
+		if _, matched := gas.MatchCallByPackage(n, c, pkg, funcs...); matched {
+			return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+// Uses des.* md5.* or rc4.*
+func NewUsesWeakCryptography(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	calls := make(map[string][]string)
+	calls["crypto/des"] = []string{"NewCipher", "NewTripleDESCipher"}
+	calls["crypto/md5"] = []string{"New", "Sum"}
+	calls["crypto/rc4"] = []string{"NewCipher"}
+	rule := &UsesWeakCryptography{
+		blacklist: calls,
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       "Use of weak cryptographic primitive",
+		},
+	}
+	return rule, []ast.Node{(*ast.CallExpr)(nil)}
+}