Skip to content

Refactor error position parsing to support path with colon.#1673

Open
jim-liu wants to merge 2 commits into
securego:masterfrom
jim-liu:patch-1
Open

Refactor error position parsing to support path with colon.#1673
jim-liu wants to merge 2 commits into
securego:masterfrom
jim-liu:patch-1

Conversation

@jim-liu
Copy link
Copy Markdown

@jim-liu jim-liu commented May 15, 2026

Refactor error position parsing with regex to support path with colon.

This is my attempt to solve #327. To reproduce the issue, run gosec with a Go file with invalid syntax either on Windows, or on Linux but in a path with colons (such as ~/home/test:code)

@jim-liu jim-liu temporarily deployed to security-review May 15, 2026 13:42 — with GitHub Actions Inactive
Copy link
Copy Markdown
Member

@ccojocar ccojocar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please can you add some unit tests for this change? Thanks

@jim-liu jim-liu temporarily deployed to security-review May 15, 2026 17:00 — with GitHub Actions Inactive
@jim-liu
Copy link
Copy Markdown
Author

jim-liu commented May 15, 2026

Please can you add some unit tests for this change? Thanks

Thanks for the heads-up - added a unit test and updated the regex to emit error messages with invalid line/column.

Comment thread analyzer_test.go
pkg := &packages.Package{
Errors: []packages.Error{
{
Pos: "C:\\file:1:2",
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you also add an Linux example of path?

For instance:

touch "my:file:with:colons.txt"

It is a valid file name in Linux/Unix.

Can you also add a tests for a path without build errors.

Comment thread analyzer.go
return nil, nil
}
errs := make(map[string][]Error)
var posRegexp = regexp.MustCompile(`^(.*?)(?::(\w+))?(?::(\w+))?$`)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about the Linux/Unix file systems? Does this regex cover the case of this file paths:

touch "my:file:with:colons.txt"

This is a valid path in LInux/Unix.

Copy link
Copy Markdown
Author

@jim-liu jim-liu May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The original regex used \d, but it will not throw errors for positions with invalid path like path.go:one:two and will instead treat the position as path.

I updated to regex to use \w in order to throw errors when parsing positions with invalid line/column. However it will fail path with colons but without extension to fail if the position has no line nor column.

So the updated regex actually worked for your particular case (because of the .txt) but won't work if it's my:file:with:colons.

@jim-liu jim-liu deployed to security-review May 15, 2026 17:39 — with GitHub Actions Active
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants