Skip to content

Commit

Permalink
tests/csdiff: help csdiff to find the correct key event
Browse files Browse the repository at this point in the history
The 2nd event is a key event in the following finding from Coverity:
```
Error: SOCKET_ACCEPT_ALL_ORIGINS (CWE-942):
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "Upgrader.CheckOrigin()" always returns "true" to accept requests from all origins.
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: Modify the "Upgrader.CheckOrigin()" function to only return "true" for trusted origins, or remove the function completely since the default "Upgrader" will only create "WebSocket" connections with clients from the same origin.
```

Related: https://issues.redhat.com/browse/OSH-552
Closes: #165
  • Loading branch information
kdudka committed Feb 22, 2024
1 parent 75a2a82 commit 4a17373
Show file tree
Hide file tree
Showing 5 changed files with 1 addition and 37 deletions.
9 changes: 0 additions & 9 deletions tests/csdiff/diff-misc/19-cov-parser-key-event-add-z.err
Original file line number Diff line number Diff line change
@@ -1,9 +0,0 @@
Error: SOCKET_ACCEPT_ALL_ORIGINS (CWE-942):
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "Upgrader.CheckOrigin()" always returns "true" to accept requests from all origins.
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: Modify the "Upgrader.CheckOrigin()" function to only return "true" for trusted origins, or remove the function completely since the default "Upgrader" will only create "WebSocket" connections with clients from the same origin.
# 300| // don't return errors to maintain backwards compatibility
# 301| }
# 302|-> u.CheckOrigin = func(r *http.Request) bool {
# 303| // allow all connections by default
# 304| return true
9 changes: 0 additions & 9 deletions tests/csdiff/diff-misc/19-cov-parser-key-event-add.err
Original file line number Diff line number Diff line change
@@ -1,9 +0,0 @@
Error: SOCKET_ACCEPT_ALL_ORIGINS (CWE-942):
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "Upgrader.CheckOrigin()" always returns "true" to accept requests from all origins.
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: Modify the "Upgrader.CheckOrigin()" function to only return "true" for trusted origins, or remove the function completely since the default "Upgrader" will only create "WebSocket" connections with clients from the same origin.
# 300| // don't return errors to maintain backwards compatibility
# 301| }
# 302|-> u.CheckOrigin = func(r *http.Request) bool {
# 303| // allow all connections by default
# 304| return true
9 changes: 0 additions & 9 deletions tests/csdiff/diff-misc/19-cov-parser-key-event-fix-z.err
Original file line number Diff line number Diff line change
@@ -1,9 +0,0 @@
Error: SOCKET_ACCEPT_ALL_ORIGINS (CWE-942):
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "Upgrader.CheckOrigin()" always returns "true" to accept requests from all origins.
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: Modify the "Upgrader.CheckOrigin()" function to only return "true" for trusted origins, or remove the function completely since the default "Upgrader" will only create "WebSocket" connections with clients from the same origin.
# 300| // don't return errors to maintain backwards compatibility
# 301| }
# 302|-> u.CheckOrigin = func(r *http.Request) bool {
# 303| // allow all connections by default
# 304| return true
9 changes: 0 additions & 9 deletions tests/csdiff/diff-misc/19-cov-parser-key-event-fix.err
Original file line number Diff line number Diff line change
@@ -1,9 +0,0 @@
Error: SOCKET_ACCEPT_ALL_ORIGINS (CWE-942):
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "Upgrader.CheckOrigin()" always returns "true" to accept requests from all origins.
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: Modify the "Upgrader.CheckOrigin()" function to only return "true" for trusted origins, or remove the function completely since the default "Upgrader" will only create "WebSocket" connections with clients from the same origin.
# 300| // don't return errors to maintain backwards compatibility
# 301| }
# 302|-> u.CheckOrigin = func(r *http.Request) bool {
# 303| // allow all connections by default
# 304| return true
2 changes: 1 addition & 1 deletion tests/csdiff/diff-misc/19-cov-parser-key-event-new.err
Original file line number Diff line number Diff line change
Expand Up @@ -2811,7 +2811,7 @@ grafana-9.2.10/vendor/github.com/gorilla/websocket/compression.go:36: null_metho
# 38| }

Error: SOCKET_ACCEPT_ALL_ORIGINS (CWE-942):
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
# XXX: help csdiff to find the correct key event -- grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "Upgrader.CheckOrigin()" always returns "true" to accept requests from all origins.
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: Modify the "Upgrader.CheckOrigin()" function to only return "true" for trusted origins, or remove the function completely since the default "Upgrader" will only create "WebSocket" connections with clients from the same origin.
# 300| // don't return errors to maintain backwards compatibility
Expand Down

0 comments on commit 4a17373

Please sign in to comment.