git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #719 from grnhse/gosec-x-oauth-basic-skip

Add `x-oauth-basic` nosec annotation & address gosec unhandled errors

commit35ed7a313b733e4091f1f0453f0c0ca6d22d5a60 authorNick Meves <nick.meves@greenhouse.io> dateTue 11 Aug 2020, 11:56 (6 years ago) parentd69fd6ab6e78ef
3 files changed+10−4
CHANGELOG.md+1 pkg/logger/logger.go+8−4 pkg/middleware/jwt_session.go+1
CHANGELOG.md+1
@@ -11,6 +11,7 @@
1111
1212## Changes since v6.0.0
1313
14+- [#719](https://github.com/oauth2-proxy/oauth2-proxy/pull/719) Add Gosec fixes to areas that are intermittently flagged on PRs (@NickMeves)
1415- [#718](https://github.com/oauth2-proxy/oauth2-proxy/pull/718) Allow Logging to stdout with separate Error Log Channel
1516- [#690](https://github.com/oauth2-proxy/oauth2-proxy/pull/690) Address GoSec security findings & remediate (@NickMeves)
1617- [#689](https://github.com/oauth2-proxy/oauth2-proxy/pull/689) Fix finicky logging_handler_test from time drift (@NickMeves)
pkg/logger/logger.go+8−4
@@ -144,11 +144,10 @@ func (l *Logger) formatLogMessage(calldepth int, message string) []byte {
144144 panic(err)
145145 }
146146
147− _, err = l.writer.Write([]byte("\n"))
147+ _, err = logBuff.Write([]byte("\n"))
148148 if err != nil {
149149 panic(err)
150150 }
151− logBuff.Write([]byte("\n"))
152151
153152 return logBuff.Bytes()
154153}
@@ -162,11 +161,16 @@ func (l *Logger) Output(lvl Level, calldepth int, message string) {
162161 return
163162 }
164163 msg := l.formatLogMessage(calldepth, message)
164+
165+ var err error
165166 switch lvl {
166167 case ERROR:
167− l.errWriter.Write(msg)
168+ _, err = l.errWriter.Write(msg)
168169 default:
169− l.writer.Write(msg)
170+ _, err = l.writer.Write(msg)
171+ }
172+ if err != nil {
173+ panic(err)
170174 }
171175}
172176
pkg/middleware/jwt_session.go+1
@@ -121,6 +121,7 @@ func (j *jwtSessionLoader) getBasicToken(token string) (string, error) {
121121 // check user, user+password, or just password for a token
122122 if j.jwtRegex.MatchString(user) {
123123 // Support blank passwords or magic `x-oauth-basic` passwords - nothing else
124+ /* #nosec G101 */
124125 if password == "" || password == "x-oauth-basic" {
125126 return user, nil
126127 }