gosec icon indicating copy to clipboard operation
gosec copied to clipboard

rules/sdk: G703 errors not propagated should obey hash.Hash.Write not returning an error

Open odeke-em opened this issue 2 years ago • 0 comments

I've seen this error

[/go/src/github.com/cosmos/cosmos-sdk/crypto/hd/hdpath.go:269] - G703 (CWE-): Returned error is not propagated up the stack. (Confidence: HIGH, Severity: LOW)
    268: 	// sha512 does not err
  > 269: 	_, _ = mac.Write(data)
    270:

but really if we examine the signature per https://pkg.go.dev/hash#Hash we can see Screen Shot 2022-10-21 at 9 30 25 PM

We should check that the writer was of the type hash.Hash and ignore such reports.

odeke-em avatar Oct 22 '22 04:10 odeke-em