forks/go-ethereum
1
0
Fork 1
mirror of https://github.com/ethereum/go-ethereum.git synced 2026-07-26 14:46:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add CodeQL (#1037)

Browse source 
* dev: add: codeQL

* dev: chg: solve codeQL high vulns

* dev: chg: remove js scan after dismissing relative issues

* dev: chg: fix size allocation checks

* dev: chg: fix size allocation checks

* dev: chg: use math.MaxUint8 for incorrect coversion for integer

* dev: chg: revert on one check / return error on trezorExchange func

* dev: chg: remove checks on logger as not harmful

* dev: chg: bump govuln action go versions

* dev: chg: name of CI for govuln

* dev: chg: bump x/net to 0.17 as per PR-1038

* dev: chg: remove snyk files
This commit is contained in:
marcello33 2023-10-16 09:28:53 +02:00 committed by GitHub
parent db1562bbe2
commit 1a81777184
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 70 additions and 56 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

41
.github/workflows/codeql.yml vendored Normal file
View file

@ -0,0 +1,41 @@
name: "CodeQL"
on:
push:
branches: [ "master", "develop" ]
pull_request:
branches: [ "master", "develop" ]
schedule:
- cron: '0 0 * * *'
jobs:
analyze:
name: Analyze
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [ 'go' ]
steps:
- name: Checkout repository
uses: actions/checkout@v3
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
- name: Autobuild
uses: github/codeql-action/autobuild@v2
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
with:
category: "/language:${{matrix.language}}"

6
.github/workflows/security-ci.yml → .github/workflows/govuln.yml vendored
View file

@ -1,4 +1,4 @@
name: Security CI
name: Govuln
on: [ push, pull_request ]
jobs:
@ -8,12 +8,12 @@ jobs:
steps:
- uses: actions/checkout@v3
- name: Running govulncheck
uses: Templum/govulncheck-action@v0.10.1
uses: Templum/govulncheck-action@v1.0.0
continue-on-error: true
env:
DEBUG: "true"
with:
go-version: 1.20.5
go-version: 1.21
package: ./...
github-token: ${{ secrets.GITHUB_TOKEN }}
fail-on-vuln: true

41
.snyk
View file

@ -1,41 +0,0 @@
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.25.0
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
ignore:
'snyk:lic:golang:github.com:karalabe:usb:LGPL-3.0':
- '*':
reason: 'As open source org, we have no issues with licenses'
created: 2022-11-11T08:06:37.028Z
'snyk:lic:golang:github.com:mitchellh:cli:MPL-2.0':
- '*':
reason: 'As open source org, we have no issues with licenses'
created: 2022-11-11T08:07:42.661Z
'snyk:lic:golang:github.com:hashicorp:hcl:v2:MPL-2.0':
- '*':
reason: 'As open source org, we have no issues with licenses'
created: 2022-11-11T08:09:08.112Z
'snyk:lic:golang:github.com:hashicorp:go-multierror:MPL-2.0':
- '*':
reason: 'As open source org, we have no issues with licenses'
created: 2022-11-11T08:09:14.673Z
'snyk:lic:golang:github.com:hashicorp:go-bexpr:MPL-2.0':
- '*':
reason: 'As open source org, we have no issues with licenses'
created: 2022-11-11T08:09:21.843Z
'snyk:lic:golang:github.com:hashicorp:errwrap:MPL-2.0':
- '*':
reason: 'As open source org, we have no issues with licenses'
created: 2022-11-11T08:09:28.257Z
'snyk:lic:golang:github.com:ethereum:go-ethereum:LGPL-3.0':
- '*':
reason: 'As open source org, we have no issues with licenses'
created: 2022-11-11T08:09:35.273Z
'snyk:lic:golang:github.com:maticnetwork:polyproto:GPL-3.0':
- '*':
reason: 'As open source org, we have no issues with licenses'
created: 2022-11-11T08:09:41.635Z
'SNYK-GOLANG-GOLANGORGXNETHTTP2-3160322':
- '*':
reason: 'grpc working on a release to fix the issue'
created: 2022-12-12T06:50:00.000Z
patch: {}

9
accounts/usbwallet/trezor.go
View file

@ -306,7 +306,14 @@ func (w *trezorDriver) trezorExchange(req proto.Message, results ...proto.Messag
return 0, err
}
payload := make([]byte, 8+len(data))
var payload []byte
if len(data) < 64*1024*1024 {
payload = make([]byte, 8+len(data))
} else {
return 0, errors.New("data too large")
}
copy(payload, []byte{0x23, 0x23})
binary.BigEndian.PutUint16(payload[2:], trezor.Type(req))
binary.BigEndian.PutUint32(payload[4:], uint32(len(data)))

8
go.mod
View file

@ -77,11 +77,11 @@ require (
github.com/tendermint/tendermint v0.34.21
github.com/tyler-smith/go-bip39 v1.1.0
github.com/urfave/cli/v2 v2.17.2-0.20221006022127-8f469abc00aa
golang.org/x/crypto v0.11.0
golang.org/x/crypto v0.14.0
golang.org/x/exp v0.0.0-20230206171751-46f607a40771
golang.org/x/sync v0.3.0
golang.org/x/sys v0.12.0
golang.org/x/text v0.11.0
golang.org/x/sys v0.13.0
golang.org/x/text v0.13.0
golang.org/x/time v0.3.0
golang.org/x/tools v0.10.0
gopkg.in/natefinch/lumberjack.v2 v2.0.0
@ -159,7 +159,7 @@ require (
go.opentelemetry.io/otel/sdk v1.19.0
go.uber.org/goleak v1.2.1
golang.org/x/mod v0.11.0 // indirect
golang.org/x/net v0.12.0 // indirect
golang.org/x/net v0.17.0 // indirect
gonum.org/v1/gonum v0.11.0
google.golang.org/grpc v1.58.2
google.golang.org/protobuf v1.31.0

13
go.sum
View file

@ -2239,8 +2239,9 @@ golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw
golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@ -2400,8 +2401,9 @@ golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@ -2596,8 +2598,8 @@ golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@ -2628,8 +2630,9 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

8
p2p/enode/localnode.go
View file

@ -19,6 +19,7 @@ package enode
import (
"crypto/ecdsa"
"fmt"
"math"
"net"
"reflect"
"strconv"
@ -211,8 +212,11 @@ func (ln *LocalNode) SetFallbackUDP(port int) {
ln.mu.Lock()
defer ln.mu.Unlock()
ln.endpoint4.fallbackUDP = uint16(port)
ln.endpoint6.fallbackUDP = uint16(port)
if port > 0 && port <= math.MaxUint16 {
ln.endpoint4.fallbackUDP = uint16(port)
ln.endpoint6.fallbackUDP = uint16(port)
}
ln.updateEndpoints()
}