Add semgrep rules for wrong error return (#341)

* Add semgrep rule 'if-inplace-func-incorrect-nil-err-return'.

* Add experimental semgrep rule 'if-incorrect-nil-err-return'.

Put in experimental directory because of huge count of false positives.

* Add '.semgrep/rules' config to semgrep CI job.

* Semgrep rule 'if-incorrect-nil-err-return' moved to regular rules.

---------

Co-authored-by: Alexey Kiselev <[email protected]>

Author: nickeskov

.github/workflows/security.yml

@@ -47,7 +47,7 @@ jobs:
               semgrep ci --config="auto" --config="r/default" --config="r/go" --config="r/dgryski" \
                 --config="r/trailofbits" --config="r/dockerfile" --config="r/bash" \
                 --config="r/problem-based-packs" --config="r/generic" --config="r/yaml" --config="r/json" \
-                --sarif --dataflow-traces --output=semgrep.sarif --max-target-bytes=2MB
+                --config="./.semgrep/rules" --sarif --dataflow-traces --output=semgrep.sarif --max-target-bytes=2MB
               EXIT_CODE=$?
               if [ "$EXIT_CODE" = "0" ] || [ "$EXIT_CODE" = "1" ]
               then

.semgrep/rules/if-incorrect-nil-err-return.yaml

@@ -0,0 +1,47 @@
+rules:
+  - id: if-incorrect-nil-err-return
+    languages: [go]
+    severity: WARNING
+    message: |
+      WARNING: A local variable '$ERR' is checked for nil, but a different variable is returned.
+      Ensure that the returned variable is the one that was checked or properly wrapped!
+    patterns:
+      - metavariable-regex:
+          metavariable: $ERR
+          regex: .*(?i)err # using .* to allow prefixes, because regex matching is left anchored.
+
+      - pattern: |
+          if $ERR != nil {
+              ...
+              return ..., $OTHERERR
+          }
+
+      - pattern-not: |
+          if $ERR != nil {
+              ...
+              return ..., $ERR
+          }
+      - pattern-not: |
+          if $ERR != nil {
+              ...
+              return ..., $ANYFUNC(..., $ERR, ...)
+          }
+      - pattern-not: |
+          if $ERR != nil {
+              ...
+              return ..., $ANYFUNC(..., $ANYFUNC1(..., $ERR, ...), ...)
+          }
+      - pattern-not: |
+          if $ERR != nil {
+              ...
+              $NEWERR := $ANYFUNC(..., $ERR, ...)
+              ...
+              return nil, $NEWERR
+          }
+      - pattern-not: |
+          if $ERR != nil {
+              ...
+              $NEWERR := $ANYFUNC(..., $ERR, ...)
+              ...
+              return ..., $ANYFUNC1(..., $NEWERR, ...)
+          }

.semgrep/rules/if-inplace-func-incorrect-nil-err-return.yaml

@@ -0,0 +1,47 @@
+rules:
+  - id: if-inplace-func-incorrect-nil-err-return
+    languages: [go]
+    severity: WARNING
+    message: |
+      WARNING: A local variable '$ERR' is checked for nil, but a different variable is returned.
+      Ensure that the returned variable is the one that was checked or properly wrapped!
+    patterns:
+      - metavariable-regex:
+          metavariable: $ERR
+          regex: .*(?i)err # using .* to allow prefixes, because regex matching is left anchored.
+
+      - pattern: |
+          if $ERR := $FUNC(...); $ERR != nil {
+              ...
+              return ..., $OTHERERR
+          }
+
+      - pattern-not: |
+          if $ERR := $FUNC(...); $ERR != nil {
+              ...
+              return ..., $ERR
+          }
+      - pattern-not: |
+          if $ERR := $FUNC(...); $ERR != nil {
+              ...
+              return ..., $ANYFUNC(..., $ERR, ...)
+          }
+      - pattern-not: |
+          if $ERR := $FUNC(...); $ERR != nil {
+              ...
+              return ..., $ANYFUNC(..., $ANYFUNC1(..., $ERR, ...), ...)
+          }
+      - pattern-not: |
+          if $ERR := $FUNC(...); $ERR != nil {
+              ...
+              $NEWERR := $ANYFUNC(..., $ERR, ...)
+              ...
+              return nil, $NEWERR
+          }
+      - pattern-not: |
+          if $ERR := $FUNC(...); $ERR != nil {
+              ...
+              $NEWERR := $ANYFUNC(..., $ERR, ...)
+              ...
+              return ..., $ANYFUNC1(..., $NEWERR, ...)
+          }