"Missing function body" error when parsing calls to assembly code

[sudo-bmitch]

"Missing function body" error when parsing calls to assembly code

[ccojocar]

This is because gosec executes the scan in the folder provider as input, and in this case in the ./cpu folder there ins't any go.mod file found.

If the scan is executed in the root of the folder where the go.mod is available, it will be successful. You can scan the whole module with: gosec -terse ./....

[sudo-bmitch]

@ccojocar the error still occurs if the full project is scanned, there's just a lot more output to scan through to see it and I'm trying to keep the example a minimal real world demonstration.

[ccojocar]

I see but looking at the code, it seems that those functions are without body and they are implemented outside of Go in C/assembly.

https://go.googlesource.com/sys/+/refs/heads/master/cpu/cpu_gc_x86.go#11

I think you can ignore these errors.

[sudo-bmitch]

They are not being ignored because the scanner exits with a non-zero return code.

[ccojocar]

The CFiles/SFiles are not included in the package loading just the CgoFiles (which are go files with import "C" inside). This is why the compilation fails in this case. You can use the -no-fail argument if you want to ignore them.

[sudo-bmitch]

Using -no-fail effectively disables the scanner. That's something I can do by just removing the scanner from my project.

[ccojocar]

Unfortunately the packages.Load doesn't parse the assembly implementation for functions without body. Even when the SFiles are provided to the loader, it returns the following error:

Golang errors in file: [cpu]:

  > [line 0 : column 0] - loading files from package "cpu": -: named files must be .go files: cpu/cpu_x86.s

There isn't much we can do on gosec side about this. If you find a solution to this problem, I happy to include it. Just let me know.

You can exclude the folders that have assembly implementation for function without body and keep scanning for purego or cgo folder/packages in your module.

[sudo-bmitch]

Why not give the ability to ignore the errors and not cause a non-zero exit when they are the only error encountered?