nosec gosec (#490)

scan/nogit.go

@@ -84,7 +84,7 @@ func (ngs *NoGitScanner) Scan() (Report, error) {
 				}
 			}
 
-			f, err := os.Open(p)
+			f, err := os.Open(p) // #nosec
 			if err != nil {
 				return err
 			}
@@ -131,7 +131,9 @@ func (ngs *NoGitScanner) Scan() (Report, error) {
 	}
 
 	go func() {
-		g.Wait()
+		if err := g.Wait(); err != nil {
+			log.Error(err)
+		}
 		close(leaks)
 	}()
 

scan/repo.go

@@ -98,7 +98,9 @@ func (rs *RepoScanner) Scan() (Report, error) {
 	}
 
 	go func() {
-		g.Wait()
+		if err := g.Wait(); err != nil {
+			log.Error(err)
+		}
 		close(leaks)
 	}()
 

scan/report.go

@@ -46,7 +46,7 @@ func WriteReport(report Report, opts options.Options, cfg config.Config) error {
 	if err != nil {
 		return err
 	}
-	defer file.Close()
+	defer rable(file.Close)
 
 	if opts.Report != "" {
 		switch opts.ReportFormat {
@@ -59,9 +59,15 @@ func WriteReport(report Report, opts options.Options, cfg config.Config) error {
 			}
 		case "csv":
 			w := csv.NewWriter(file)
-			_ = w.Write([]string{"repo", "line", "commit", "offender", "leakURL", "rule", "tags", "commitMsg", "author", "email", "file", "date"})
+			err = w.Write([]string{"repo", "line", "commit", "offender", "leakURL", "rule", "tags", "commitMsg", "author", "email", "file", "date"})
+			if err != nil {
+				return err
+			}
 			for _, leak := range report.Leaks {
-				w.Write([]string{leak.Repo, leak.Line, leak.Commit, leak.Offender, leak.LeakURL, leak.Rule, leak.Tags, leak.Message, leak.Author, leak.Email, leak.File, leak.Date.Format(time.RFC3339)})
+				err := w.Write([]string{leak.Repo, leak.Line, leak.Commit, leak.Offender, leak.LeakURL, leak.Rule, leak.Tags, leak.Message, leak.Author, leak.Email, leak.File, leak.Date.Format(time.RFC3339)})
+				if err != nil {
+					return err
+				}
 			}
 			w.Flush()
 		case "sarif":

scan/utils.go

@@ -178,7 +178,7 @@ func optsToCommits(opts options.Options) ([]string, error) {
 	if err != nil {
 		return []string{}, err
 	}
-	defer file.Close()
+	defer rable(file.Close)
 
 	scanner := bufio.NewScanner(file)
 	var commits []string
@@ -218,3 +218,10 @@ func extractLine(patchContent string, leak Leak, lineLookup map[string]bool) int
 	}
 	return defaultLineNumber
 }
+
+// rable is the second half of deferrable... mainly used for defer file.Close()
+func rable(f func() error) {
+	if err := f(); err != nil {
+		log.Error(err)
+	}
+}