From 0ef88d0f05e364ae40498f9e8d5880b1fbb76655 Mon Sep 17 00:00:00 2001
From: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
Date: Mon, 23 Sep 2024 10:07:57 -0700
Subject: [PATCH] Add semgrep rules (#5042)

* Add semgrep rules

Instrument our security scanner with the ability to use custom semgrep
rules. This is inspired by the HVS teams use of semgrep.

* semgrep: add rule to detect string interpolation in WithInfoMsg

The event.WithInfoMsg function expects a set of key value tuples,
but it can easily be misunderstood to accept string interpolation
arguments. This check will error if any string interpolation verbs are
used in calls to event.WithInfoMsg
---
 .semgrep/event-with-info-msg.yaml | 13 +++++++++++++
 scan.hcl                          |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 .semgrep/event-with-info-msg.yaml

diff --git a/.semgrep/event-with-info-msg.yaml b/.semgrep/event-with-info-msg.yaml
new file mode 100644
index 000000000..af1c32291
--- /dev/null
+++ b/.semgrep/event-with-info-msg.yaml
@@ -0,0 +1,13 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+rules:
+  - id: with-info-msg-string-interpolation
+    languages:
+      - go
+    severity: ERROR
+    message: Use of WithInfoMsg with string interpolation. WithInfoMsg expects kv
+      tuples.
+    # Source for Go string interpolation verbs:
+    # https://pkg.go.dev/fmt#hdr-Printing.
+    pattern: event.WithInfoMsg("=~/.*%(((\[\d+\])|[\d|\.|#|+|\-| |\*])*)?[s|v|q|d|T|t|b|c|o|O|x|X|U|e|E|f|F|g|G|p].*/",...)
diff --git a/scan.hcl b/scan.hcl
index 245f9a373..bc6be24ef 100644
--- a/scan.hcl
+++ b/scan.hcl
@@ -15,7 +15,7 @@ repository {
   plugin "semgrep" {
     use_git_ignore = true
     exclude = ["*_test.go", "website/*", "testing/*"]
-    config = ["p/gosec"]
+    config = ["p/gosec", ".semgrep/"]
   }
   
   plugin "codeql" {