Improve go-echo analyzer (detect static handler)

owasp-noir · Aug 10, 2023 · 394e1ab · 394e1ab
1 parent e21af3b
commit 394e1ab
Show file tree

Hide file tree

Showing 2 changed files with 81 additions and 20 deletions.
diff --git a/spec/analyzer/analyzer_go_echo_spec.cr b/spec/analyzer/analyzer_go_echo_spec.cr
@@ -5,31 +5,47 @@ describe "analyzer_go_echo" do
   options = default_options()
   instance = AnalyzerGoEcho.new(options)
 
-  it "instance.get_route_path_go_echo - GET" do
-    instance.get_route_path_go_echo("e.GET(\"/\", func(c echo.Context) error {").should eq("/")
+  it "instance.get_route_path - GET" do
+    instance.get_route_path("e.GET(\"/\", func(c echo.Context) error {").should eq("/")
   end
-  it "instance.get_route_path_go_echo - POST" do
-    instance.get_route_path_go_echo("e.POST(\"/\", func(c echo.Context) error {").should eq("/")
+  it "instance.get_route_path - POST" do
+    instance.get_route_path("e.POST(\"/\", func(c echo.Context) error {").should eq("/")
   end
-  it "instance.get_route_path_go_echo - PUT" do
-    instance.get_route_path_go_echo("e.PUT(\"/\", func(c echo.Context) error {").should eq("/")
+  it "instance.get_route_path - PUT" do
+    instance.get_route_path("e.PUT(\"/\", func(c echo.Context) error {").should eq("/")
   end
-  it "instance.get_route_path_go_echo - DELETE" do
-    instance.get_route_path_go_echo("e.DELETE(\"/\", func(c echo.Context) error {").should eq("/")
+  it "instance.get_route_path - DELETE" do
+    instance.get_route_path("e.DELETE(\"/\", func(c echo.Context) error {").should eq("/")
   end
-  it "instance.get_route_path_go_echo - PATCH" do
-    instance.get_route_path_go_echo("e.PATCH(\"/\", func(c echo.Context) error {").should eq("/")
+  it "instance.get_route_path - PATCH" do
+    instance.get_route_path("e.PATCH(\"/\", func(c echo.Context) error {").should eq("/")
   end
-  it "instance.get_route_path_go_echo - HEAD" do
-    instance.get_route_path_go_echo("e.HEAD(\"/\", func(c echo.Context) error {").should eq("/")
+  it "instance.get_route_path - HEAD" do
+    instance.get_route_path("e.HEAD(\"/\", func(c echo.Context) error {").should eq("/")
   end
-  it "instance.get_route_path_go_echo - OPTIONS" do
-    instance.get_route_path_go_echo("e.OPTIONS(\"/\", func(c echo.Context) error {").should eq("/")
+  it "instance.get_route_path - OPTIONS" do
+    instance.get_route_path("e.OPTIONS(\"/\", func(c echo.Context) error {").should eq("/")
   end
-  it "instance.get_route_path_go_echo - customContext1" do
-    instance.get_route_path_go_echo("customEnv.OPTIONS(\"/\", func(c echo.Context) error {").should eq("/")
+  it "instance.get_route_path - customContext1" do
+    instance.get_route_path("customEnv.OPTIONS(\"/\", func(c echo.Context) error {").should eq("/")
   end
-  it "instance.get_route_path_go_echo - customContext2" do
-    instance.get_route_path_go_echo("customEnv.OPTIONS(\"/\", func(myContext echo.Context) error {").should eq("/")
+  it "instance.get_route_path - customContext2" do
+    instance.get_route_path("customEnv.OPTIONS(\"/\", func(myContext echo.Context) error {").should eq("/")
+  end
+
+  it "instance.get_static_path - Static" do
+    rtn = {
+      "static_path" => "/",
+      "file_path"   => "public",
+    }
+    instance.get_static_path("e.Static(\"/\", \"public\")").should eq(rtn)
+  end
+
+  it "instance.get_static_path - Static" do
+    rtn = {
+      "static_path" => "/abcd",
+      "file_path"   => "./public",
+    }
+    instance.get_static_path("e.Static(\"/abcd\", \"./public\")").should eq(rtn)
   end
 end
diff --git a/src/analyzer/analyzers/analyzer_go_echo.cr b/src/analyzer/analyzers/analyzer_go_echo.cr
@@ -3,28 +3,73 @@ require "../../models/analyzer"
 class AnalyzerGoEcho < Analyzer
   def analyze
     # Source Analysis
+    public_dirs = [] of (Hash(String, String))
     Dir.glob("#{base_path}/**/*") do |path|
       next if File.directory?(path)
       if File.exists?(path) && File.extname(path) == ".go"
         File.open(path, "r") do |file|
           file.each_line do |line|
             if line.includes?(".GET(") || line.includes?(".POST(") || line.includes?(".PUT(") || line.includes?(".DELETE(")
-              get_route_path_go_echo(line).tap do |route_path|
+              get_route_path(line).tap do |route_path|
                 if route_path.size > 0
                   result << Endpoint.new("#{url}#{route_path}", line.split(".")[1].split("(")[0])
                 end
               end
             end
+
+            if line.includes?("Static(")
+              get_static_path(line).tap do |static_path|
+                if static_path.size > 0
+                  public_dirs << static_path
+                end
+              end
+            end
           end
         end
       end
     end
+
+    public_dirs.each do |p_dir|
+      Dir.glob("#{p_dir["file_path"]}/**/*") do |path|
+        next if File.directory?(path)
+        if File.exists?(path)
+          if p_dir["static_path"].ends_with?("/")
+            p_dir["static_path"] = p_dir["static_path"][0..-2]
+          end
+
+          result << Endpoint.new("#{url}#{p_dir["static_path"]}#{path.gsub(p_dir["file_path"], "")}", "GET")
+        end
+      end
+    end
+
     Fiber.yield
 
     result
   end
 
-  def get_route_path_go_echo(line : String) : String
+  def get_static_path(line : String) : Hash(String, String)
+    first = line.strip.split("(")
+    if first.size > 1
+      second = first[1].split(",")
+      if second.size > 1
+        static_path = second[0].gsub("\"", "")
+        file_path = second[1].gsub("\"", "").gsub(" ", "").gsub(")", "")
+        rtn = {
+          "static_path" => static_path,
+          "file_path"   => file_path,
+        }
+
+        return rtn
+      end
+    end
+
+    {
+      "static_path" => "",
+      "file_path"   => "",
+    }
+  end
+
+  def get_route_path(line : String) : String
     first = line.strip.split("(")
     if first.size > 1
       second = first[1].split(",")