gosec

Makefile

@@ -283,6 +283,11 @@ render-command-tests: dist
 unittests:
 	hack/unittests.sh
 
+.PHONY: gosec
+gosec:
+	@echo "Running gosec"
+	hack/gosec.sh
+
 .PHONY: gofmt
 gofmt:
 	@echo "Running gofmt"
@@ -304,7 +309,7 @@ generate: deps-update gofmt manifests generate-code generate-latest-dev-csv gene
 	@echo
 
 .PHONY: verify
-verify: golint govet generate
+verify: golint govet gosec generate
 	@echo "Verifying that all code is committed after updating deps and formatting and generating code"
 	hack/verify-generated.sh
 

api/v2/performanceprofile_validation.go

@@ -201,7 +201,7 @@ func (r *PerformanceProfile) validateHugePages() field.ErrorList {
 			allErrs = append(allErrs, field.Invalid(field.NewPath("spec.hugepages.pages"), r.Spec.HugePages.Pages, fmt.Sprintf("the page size should be equal to %q or %q", hugepagesSize1G, hugepagesSize2M)))
 		}
 
-		allErrs = append(allErrs, r.validatePageDuplication(&page, r.Spec.HugePages.Pages[i+1:])...)
+		allErrs = append(allErrs, r.validatePageDuplication(&r.Spec.HugePages.Pages[i], r.Spec.HugePages.Pages[i+1:])...)
 	}
 
 	return allErrs

cmd/performance-profile-creator/cmd/root.go

@@ -291,7 +291,9 @@ func makeClusterInfoFromClusterData(cluster ClusterData) ClusterInfo {
 }
 
 func showClusterInfoJSON(cInfo ClusterInfo) {
-	json.NewEncoder(os.Stdout).Encode(cInfo)
+	if err := json.NewEncoder(os.Stdout).Encode(cInfo); err != nil {
+		panic(fmt.Errorf("Could not create JSON, err: %s", err))
+	}
 }
 
 func showClusterInfoLog(cInfo ClusterInfo) {
@@ -506,7 +508,9 @@ func createProfile(profileData ProfileData) {
 
 	// write CSV to out dir
 	writer := strings.Builder{}
-	csvtools.MarshallObject(&profile, &writer)
+	if err := csvtools.MarshallObject(&profile, &writer); err != nil {
+		panic(fmt.Errorf("Could not marshal profile, err: %s", err))
+	}
 
 	fmt.Printf("%s", writer.String())
 }

controllers/status.go

@@ -242,10 +242,10 @@ func (r *PerformanceProfileReconciler) getTunedConditionsByProfile(profile *perf
 		isApplied := true
 		var tunedDegradedCondition *tunedv1.ProfileStatusCondition
 
-		for _, condition := range tunedProfile.Status.Conditions {
+		for i, condition := range tunedProfile.Status.Conditions {
 			if (condition.Type == tunedv1.TunedDegraded) && condition.Status == corev1.ConditionTrue {
 				isDegraded = true
-				tunedDegradedCondition = &condition
+				tunedDegradedCondition = &tunedProfile.Status.Conditions[i]
 			}
 
 			if (condition.Type == tunedv1.TunedProfileApplied) && condition.Status == corev1.ConditionFalse {

functests-performance-profile-creator/1_performance-profile_creator/ppc.go

@@ -77,7 +77,7 @@ var _ = Describe("[rfe_id:OCP-38968][ppc] Performance Profile Creator", func() {
 			err = yaml.Unmarshal(out, profile)
 			Expect(err).To(BeNil(), "failed to unmarshal the output yaml for '%s': %v", expectedProfilePath, err)
 
-			bytes, err := ioutil.ReadFile(expectedProfilePath)
+			bytes, err := ioutil.ReadFile(filepath.Clean(expectedProfilePath))
 			Expect(err).To(BeNil(), "failed to read the expected yaml for '%s': %v", expectedProfilePath, err)
 
 			expectedProfile := &performancev2.PerformanceProfile{}
@@ -107,7 +107,7 @@ var _ = Describe("[rfe_id:OCP-38968][ppc] Performance Profile Creator", func() {
 			err = json.Unmarshal(out, &cInfo)
 			Expect(err).To(BeNil(), "failed to unmarshal the output json for %q: %v", path, err)
 			expectedClusterInfoPath := filepath.Join(expectedInfoPath, fmt.Sprintf("%s.json", name))
-			bytes, err := ioutil.ReadFile(expectedClusterInfoPath)
+			bytes, err := ioutil.ReadFile(filepath.Clean(expectedClusterInfoPath))
 			Expect(err).To(BeNil(), "failed to read the expected json for %q: %v", expectedClusterInfoPath, err)
 
 			var expectedInfo cmd.ClusterInfo
@@ -219,7 +219,7 @@ func getExpectedProfiles(expectedProfilesPath string, mustGatherDirs map[string]
 		}
 
 		fullFilePath := filepath.Join(expectedProfilesPath, file.Name())
-		bytes, err := ioutil.ReadFile(fullFilePath)
+		bytes, err := ioutil.ReadFile(filepath.Clean(fullFilePath))
 		Expect(err).To(BeNil(), "failed to read the ppc params file for '%s': %v", fullFilePath, err)
 
 		var ppcArgs cmd.ProfileCreatorArgs

functests/0_config/config.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
+	"path/filepath"
 	"time"
 
 	. "github.com/onsi/ginkgo"
@@ -115,10 +116,12 @@ var _ = Describe("[performance][config] Performance configuration", func() {
 
 func externalPerformanceProfile(performanceManifest string) (*performancev2.PerformanceProfile, error) {
 	performanceScheme := runtime.NewScheme()
-	performancev2.AddToScheme(performanceScheme)
+	if err := performancev2.AddToScheme(performanceScheme); err != nil {
+		return nil, fmt.Errorf("Failed to add to scheme, err: %s", err)
+	}
 
 	decode := serializer.NewCodecFactory(performanceScheme).UniversalDeserializer().Decode
-	manifest, err := ioutil.ReadFile(performanceManifest)
+	manifest, err := ioutil.ReadFile(filepath.Clean(performanceManifest))
 	if err != nil {
 		return nil, fmt.Errorf("Failed to read %s file", performanceManifest)
 	}

functests/1_performance/netqueues.go

@@ -164,8 +164,8 @@ var _ = Describe("[ref_id: 40307][pao]Resizing Network Queues", func() {
 			tunedCmd := []string{"bash", "-c",
 				fmt.Sprintf("cat /etc/tuned/openshift-node-performance-%s/tuned.conf | grep devices_udev_regex", performanceProfileName)}
 
-			for _, node := range workerRTNodes {
-				tunedPod := nodes.TunedForNode(&node, RunningOnSingleNode)
+			for i := range workerRTNodes {
+				tunedPod := nodes.TunedForNode(&workerRTNodes[i], RunningOnSingleNode)
 				out, err := pods.WaitForPodOutput(testclient.K8sClient, tunedPod, tunedCmd)
 				deviceExists := strings.ContainsAny(string(out), device)
 				Expect(deviceExists).To(BeTrue())
@@ -214,8 +214,8 @@ var _ = Describe("[ref_id: 40307][pao]Resizing Network Queues", func() {
 			tunedCmd := []string{"bash", "-c",
 				fmt.Sprintf("cat /etc/tuned/openshift-node-performance-%s/tuned.conf | grep devices_udev_regex", performanceProfileName)}
 
-			for _, node := range workerRTNodes {
-				tunedPod := nodes.TunedForNode(&node, RunningOnSingleNode)
+			for i := range workerRTNodes {
+				tunedPod := nodes.TunedForNode(&workerRTNodes[i], RunningOnSingleNode)
 				out, err := pods.WaitForPodOutput(testclient.K8sClient, tunedPod, tunedCmd)
 				deviceExists := strings.ContainsAny(string(out), device)
 				Expect(deviceExists).To(BeTrue())
@@ -269,9 +269,15 @@ var _ = Describe("[ref_id: 40307][pao]Resizing Network Queues", func() {
 			}
 			//Verify the tuned profile is created on the worker-cnf nodes:
 			tunedCmd := []string{"bash", "-c",
+<<<<<<< HEAD
 				fmt.Sprintf("cat /etc/tuned/openshift-node-performance-%s/tuned.conf | grep devices_udev_regex", performanceProfileName)}
 			for _, node := range workerRTNodes {
 				tunedPod := nodes.TunedForNode(&node, RunningOnSingleNode)
+=======
+				fmt.Sprintf("cat /etc/tuned/openshift-node-performance-performance/tuned.conf | grep devices_udev_regex")}
+			for i := range workerRTNodes {
+				tunedPod := nodes.TunedForNode(&workerRTNodes[i], RunningOnSingleNode)
+>>>>>>> e00c45ec (fix all CWE-118 issues)
 				out, err := pods.WaitForPodOutput(testclient.K8sClient, tunedPod, tunedCmd)
 				deviceExists := strings.ContainsAny(string(out), device)
 				Expect(deviceExists).To(BeTrue())
@@ -296,8 +302,8 @@ func checkDeviceSupport(workernodes []corev1.Node, devices map[string][]int) err
 	cmdGetPhysicalDevices := []string{"find", "/sys/class/net", "-type", "l", "-not", "-lname", "*virtual*", "-printf", "%f "}
 	var channelCurrentCombined int
 	var err error
-	for _, node := range workernodes {
-		tunedPod := nodes.TunedForNode(&node, RunningOnSingleNode)
+	for i, node := range workernodes {
+		tunedPod := nodes.TunedForNode(&workernodes[i], RunningOnSingleNode)
 		phyDevs, err := pods.WaitForPodOutput(testclient.K8sClient, tunedPod, cmdGetPhysicalDevices)
 		Expect(err).ToNot(HaveOccurred())
 		for _, d := range strings.Split(string(phyDevs), " ") {