Fix semgrep scan workflow (#312)

* Clean file path

* Specific permissions for semgrep job

* Add nosemgrep rules

* Update CHANGELOG.md

.github/workflows/analysis.yml

@@ -58,6 +58,11 @@ jobs:
     name: Semgrep Scan
     if: github.actor != 'dependabot[bot]'
     uses: wabarc/.github/.github/workflows/reusable-semgrep.yml@main
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      actions: read
+      contents: read
 
   fossa:
     if: github.event_name != 'pull_request'

.semgrepignore

@@ -1 +1,5 @@
+# Common large paths
 template/views/
+
+# Common test paths
+*_test.go

CHANGELOG.md

@@ -27,6 +27,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Support for `WAYBACK_LISTEN_ADDR` override `WAYBACK_TOR_LOCAL_PORT`
   - Defaults to listen `0.0.0.0` for httpd service
 
+### Fixed
+- Fix semgrep scan workflow ([#312](https://github.com/wabarc/wayback/pull/312))
+
 ## [0.18.1] - 2022-10-30
 
 ### Fixed

cmd/wayback/pprof.go

@@ -3,6 +3,7 @@
 // license that can be found in the LICENSE file.
 package main
 
+// nosemgrep: gitlab.gosec.G108-1
 import (
 	"log"
 	"net"

cmd/wayback/wayback.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -137,7 +138,7 @@ func unmarshalArgs(args []string) (urls []*url.URL, err error) {
 
 func readFromFile(s string) (urls []*url.URL) {
 	if helper.Exists(s) {
-		file, err := os.Open(s)
+		file, err := os.Open(filepath.Clean(s))
 		if err != nil {
 			return
 		}

config/parser.go

@@ -37,7 +37,7 @@ func (p *Parser) ParseEnvironmentVariables() (*Options, error) {
 func (p *Parser) ParseFile(filename string) (*Options, error) {
 	if filename == "" {
 		for _, path := range defaultFilenames() {
-			_, err := os.Open(path)
+			_, err := os.Open(filepath.Clean(path))
 			if err != nil {
 				continue
 			}
@@ -46,7 +46,7 @@ func (p *Parser) ParseFile(filename string) (*Options, error) {
 		}
 	}
 
-	fp, err := os.Open(filename)
+	fp, err := os.Open(filepath.Clean(filename))
 	if err != nil {
 		return nil, err
 	}

publish/notion.go

@@ -265,7 +265,7 @@ func download(u *url.URL) (path string, err error) {
 	}
 	defer fd.Close()
 
-	resp, err := http.Get(u.String())
+	resp, err := http.Get(u.String()) // nosemgrep: gitlab.gosec.G104-1.G107-1, gitlab.gosec.G107-1, gitlab.gosec.G108-1
 	if err != nil {
 		return path, err
 	}

reduxer/reduxer.go

@@ -372,7 +372,7 @@ func media(ctx context.Context, dir, in string) string {
 			args = append(args, "--verbose", "--print-traffic")
 		}
 
-		cmd := exec.CommandContext(ctx, ytdl, args...)
+		cmd := exec.CommandContext(ctx, ytdl, args...) // nosemgrep: gitlab.gosec.G204-1
 		logger.Debug("youtube-dl args: %s", cmd.String())
 
 		if err := run(cmd); err != nil {
@@ -391,7 +391,7 @@ func media(ctx context.Context, dir, in string) string {
 		args := []string{
 			"--output-filename=" + fp, in,
 		}
-		cmd := exec.CommandContext(ctx, youget, args...)
+		cmd := exec.CommandContext(ctx, youget, args...) // nosemgrep: gitlab.gosec.G204-1
 		logger.Debug("youget args: %s", cmd.String())
 
 		if err := run(cmd); err != nil {

service/httpd/tor.go

@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"time"
 
 	// "github.com/ipsn/go-libtor"
@@ -115,7 +116,7 @@ func (t *Tor) torrc() string {
 	if torPortBusy() {
 		return ""
 	}
-	if _, err := os.Open(config.Opts.TorrcFile()); err != nil {
+	if _, err := os.Open(filepath.Clean(config.Opts.TorrcFile())); err != nil {
 		return ""
 	}
 	return config.Opts.TorrcFile()

service/utils.go

@@ -8,6 +8,7 @@ import (
 	"net/url"
 	"os"
 	"path"
+	"path/filepath"
 	"strings"
 	"sync"
 
@@ -116,7 +117,7 @@ func UploadToDiscord(art reduxer.Artifact) (files []*discord.File) {
 	upper := config.Opts.MaxAttachSize("discord")
 	for _, fp := range filterArtifact(art, upper) {
 		logger.Debug("open file: %s", fp)
-		rd, err := os.Open(fp)
+		rd, err := os.Open(filepath.Clean(fp))
 		if err != nil {
 			logger.Error("open file failed: %v", err)
 			continue
@@ -135,7 +136,7 @@ func UploadToSlack(client *slack.Client, art reduxer.Artifact, channel, timestam
 
 	upper := config.Opts.MaxAttachSize("slack")
 	for _, fp := range filterArtifact(art, upper) {
-		rd, e := os.Open(fp)
+		rd, e := os.Open(filepath.Clean(fp))
 		if e != nil {
 			err = errors.Wrap(err, e.Error())
 			continue