diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000000..dd40670c8d --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,41 @@ +name: "CodeQL" + +on: + push: + branches: [ "master", "develop" ] + pull_request: + branches: [ "master", "develop" ] + schedule: + - cron: '0 0 * * *' + +jobs: + analyze: + name: Analyze + runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'go' ] + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v2 + with: + languages: ${{ matrix.language }} + + - name: Autobuild + uses: github/codeql-action/autobuild@v2 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v2 + with: + category: "/language:${{matrix.language}}" diff --git a/.github/workflows/security-ci.yml b/.github/workflows/govuln.yml similarity index 84% rename from .github/workflows/security-ci.yml rename to .github/workflows/govuln.yml index 540fd9a250..3f508015c7 100644 --- a/.github/workflows/security-ci.yml +++ b/.github/workflows/govuln.yml @@ -1,4 +1,4 @@ -name: Security CI +name: Govuln on: [ push, pull_request ] jobs: @@ -8,12 +8,12 @@ jobs: steps: - uses: actions/checkout@v3 - name: Running govulncheck - uses: Templum/govulncheck-action@v0.10.1 + uses: Templum/govulncheck-action@v1.0.0 continue-on-error: true env: DEBUG: "true" with: - go-version: 1.20.5 + go-version: 1.21 package: ./... github-token: ${{ secrets.GITHUB_TOKEN }} fail-on-vuln: true diff --git a/.snyk b/.snyk deleted file mode 100644 index 285024f5bb..0000000000 --- a/.snyk +++ /dev/null @@ -1,41 +0,0 @@ -# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. -version: v1.25.0 -# ignores vulnerabilities until expiry date; change duration by modifying expiry date -ignore: - 'snyk:lic:golang:github.com:karalabe:usb:LGPL-3.0': - - '*': - reason: 'As open source org, we have no issues with licenses' - created: 2022-11-11T08:06:37.028Z - 'snyk:lic:golang:github.com:mitchellh:cli:MPL-2.0': - - '*': - reason: 'As open source org, we have no issues with licenses' - created: 2022-11-11T08:07:42.661Z - 'snyk:lic:golang:github.com:hashicorp:hcl:v2:MPL-2.0': - - '*': - reason: 'As open source org, we have no issues with licenses' - created: 2022-11-11T08:09:08.112Z - 'snyk:lic:golang:github.com:hashicorp:go-multierror:MPL-2.0': - - '*': - reason: 'As open source org, we have no issues with licenses' - created: 2022-11-11T08:09:14.673Z - 'snyk:lic:golang:github.com:hashicorp:go-bexpr:MPL-2.0': - - '*': - reason: 'As open source org, we have no issues with licenses' - created: 2022-11-11T08:09:21.843Z - 'snyk:lic:golang:github.com:hashicorp:errwrap:MPL-2.0': - - '*': - reason: 'As open source org, we have no issues with licenses' - created: 2022-11-11T08:09:28.257Z - 'snyk:lic:golang:github.com:ethereum:go-ethereum:LGPL-3.0': - - '*': - reason: 'As open source org, we have no issues with licenses' - created: 2022-11-11T08:09:35.273Z - 'snyk:lic:golang:github.com:maticnetwork:polyproto:GPL-3.0': - - '*': - reason: 'As open source org, we have no issues with licenses' - created: 2022-11-11T08:09:41.635Z - 'SNYK-GOLANG-GOLANGORGXNETHTTP2-3160322': - - '*': - reason: 'grpc working on a release to fix the issue' - created: 2022-12-12T06:50:00.000Z -patch: {} diff --git a/accounts/usbwallet/trezor.go b/accounts/usbwallet/trezor.go index 0201048ebd..5acdff3c97 100644 --- a/accounts/usbwallet/trezor.go +++ b/accounts/usbwallet/trezor.go @@ -306,7 +306,14 @@ func (w *trezorDriver) trezorExchange(req proto.Message, results ...proto.Messag return 0, err } - payload := make([]byte, 8+len(data)) + var payload []byte + + if len(data) < 64*1024*1024 { + payload = make([]byte, 8+len(data)) + } else { + return 0, errors.New("data too large") + } + copy(payload, []byte{0x23, 0x23}) binary.BigEndian.PutUint16(payload[2:], trezor.Type(req)) binary.BigEndian.PutUint32(payload[4:], uint32(len(data))) diff --git a/go.mod b/go.mod index 8c818ad99d..f16c476c74 100644 --- a/go.mod +++ b/go.mod @@ -77,11 +77,11 @@ require ( github.com/tendermint/tendermint v0.34.21 github.com/tyler-smith/go-bip39 v1.1.0 github.com/urfave/cli/v2 v2.17.2-0.20221006022127-8f469abc00aa - golang.org/x/crypto v0.11.0 + golang.org/x/crypto v0.14.0 golang.org/x/exp v0.0.0-20230206171751-46f607a40771 golang.org/x/sync v0.3.0 - golang.org/x/sys v0.12.0 - golang.org/x/text v0.11.0 + golang.org/x/sys v0.13.0 + golang.org/x/text v0.13.0 golang.org/x/time v0.3.0 golang.org/x/tools v0.10.0 gopkg.in/natefinch/lumberjack.v2 v2.0.0 @@ -159,7 +159,7 @@ require ( go.opentelemetry.io/otel/sdk v1.19.0 go.uber.org/goleak v1.2.1 golang.org/x/mod v0.11.0 // indirect - golang.org/x/net v0.12.0 // indirect + golang.org/x/net v0.17.0 // indirect gonum.org/v1/gonum v0.11.0 google.golang.org/grpc v1.58.2 google.golang.org/protobuf v1.31.0 diff --git a/go.sum b/go.sum index dd93d074de..b466e1cf66 100644 --- a/go.sum +++ b/go.sum @@ -2239,8 +2239,9 @@ golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0= golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I= -golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA= golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio= +golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= +golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= @@ -2400,8 +2401,9 @@ golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ= -golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50= golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA= +golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM= +golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -2596,8 +2598,8 @@ golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o= -golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= +golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -2628,8 +2630,9 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= -golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4= golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= +golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= diff --git a/p2p/enode/localnode.go b/p2p/enode/localnode.go index 675350907e..66a56ad4e9 100644 --- a/p2p/enode/localnode.go +++ b/p2p/enode/localnode.go @@ -19,6 +19,7 @@ package enode import ( "crypto/ecdsa" "fmt" + "math" "net" "reflect" "strconv" @@ -211,8 +212,11 @@ func (ln *LocalNode) SetFallbackUDP(port int) { ln.mu.Lock() defer ln.mu.Unlock() - ln.endpoint4.fallbackUDP = uint16(port) - ln.endpoint6.fallbackUDP = uint16(port) + if port > 0 && port <= math.MaxUint16 { + ln.endpoint4.fallbackUDP = uint16(port) + ln.endpoint6.fallbackUDP = uint16(port) + } + ln.updateEndpoints() }