diff --git a/examples/gin-server/main.go b/examples/gin-server/main.go
index b38ff09..6d00153 100644
--- a/examples/gin-server/main.go
+++ b/examples/gin-server/main.go
@@ -1,6 +1,7 @@
package main
import (
+ "log"
"net/http"
"github.com/gin-gonic/gin"
@@ -36,5 +37,7 @@ func main() {
r := setupRouter()
// Listen and Server in 0.0.0.0:8080
- r.Run(":8080")
+ if err := r.Run(":8080"); err != nil {
+ log.Fatalf("error running server: %v", err)
+ }
}
diff --git a/examples/mux-server/main.go b/examples/mux-server/main.go
index 9aa2921..107d3dd 100644
--- a/examples/mux-server/main.go
+++ b/examples/mux-server/main.go
@@ -8,12 +8,11 @@ import (
"net/http"
"time"
- "github.com/hypertrace/goagent/config"
- sdkhttp "github.com/hypertrace/goagent/sdk/instrumentation/net/http"
-
"github.com/gorilla/mux"
+ "github.com/hypertrace/goagent/config"
"github.com/hypertrace/goagent/instrumentation/hypertrace"
"github.com/hypertrace/goagent/instrumentation/opentelemetry/github.com/gorilla/hypermux"
+ sdkhttp "github.com/hypertrace/goagent/sdk/instrumentation/net/http"
)
func main() {
@@ -26,7 +25,14 @@ func main() {
r := mux.NewRouter()
r.Use(hypermux.NewMiddleware(&sdkhttp.Options{})) // here we use the mux middleware
r.HandleFunc("/foo", http.HandlerFunc(fooHandler))
- log.Fatal(http.ListenAndServe(":8081", r))
+ srv := http.Server{
+ Addr: ":8081",
+ Handler: r,
+ ReadTimeout: 60 * time.Second,
+ WriteTimeout: 60 * time.Second,
+ ReadHeaderTimeout: 60 * time.Second,
+ }
+ log.Fatal(srv.ListenAndServe())
}
type person struct {
@@ -52,5 +58,7 @@ func fooHandler(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusOK)
- w.Write([]byte(fmt.Sprintf("{\"message\": \"Hello %s\"}", p.Name)))
+ if _, err := w.Write([]byte(fmt.Sprintf("{\"message\": \"Hello %s\"}", p.Name))); err != nil {
+ log.Printf("error while writing response body: %v", err)
+ }
}
diff --git a/examples/postgres-query/main.go b/examples/postgres-query/main.go
index 051e6b6..8b2205d 100644
--- a/examples/postgres-query/main.go
+++ b/examples/postgres-query/main.go
@@ -7,7 +7,10 @@ import (
"fmt"
"os"
- "github.com/hypertrace/goagent/instrumentation/hypertrace/github.com/jackc/hyperpgx"
+ // gosec complains about this pkg not following golang repo standards
+ // "could not import github.com/hypertrace/goagent/instrumentation/hypertrace/github.com/jackc/hyperpgx (invalid package name: "")"
+ // It is caused the pkg having its own go.mod
+ "github.com/hypertrace/goagent/instrumentation/hypertrace/github.com/jackc/hyperpgx" // #nosec
)
func main() {
diff --git a/examples/sql-query/main.go b/examples/sql-query/main.go
index 10a130e..9b155ef 100644
--- a/examples/sql-query/main.go
+++ b/examples/sql-query/main.go
@@ -10,7 +10,9 @@ import (
"net/http"
"time"
- "github.com/go-sql-driver/mysql"
+ // gosec complains about github.com/go-sql-driver/mysql not following golang repo standards
+ // "could not import github.com/go-sql-driver/mysql (invalid package name: "")"
+ "github.com/go-sql-driver/mysql" // #nosec
"github.com/gorilla/mux"
"github.com/hypertrace/goagent/config"
"github.com/hypertrace/goagent/instrumentation/hypertrace"
@@ -40,7 +42,16 @@ func main() {
http.HandlerFunc(fooHandlerFunc),
"/foo",
))
- log.Fatal(http.ListenAndServe(":8081", r))
+ // Using log.Fatal(http.ListenAndServe(":8081", r)) causes a gosec timeout error.
+ // G114 (CWE-676): Use of net/http serve function that has no support for setting timeouts (Confidence: HIGH, Severity: MEDIUM)
+ srv := http.Server{
+ Addr: ":8081",
+ Handler: r,
+ ReadTimeout: 60 * time.Second,
+ WriteTimeout: 60 * time.Second,
+ ReadHeaderTimeout: 60 * time.Second,
+ }
+ log.Fatal(srv.ListenAndServe())
}
type person struct {
@@ -68,7 +79,9 @@ func fooHandler(db *sql.DB, w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusOK)
- w.Write([]byte(fmt.Sprintf("{\"message\": \"Hello %s\"}", p.Name)))
+ if _, err := w.Write([]byte(fmt.Sprintf("{\"message\": \"Hello %s\"}", p.Name))); err != nil {
+ log.Printf("errow while writing response body: %v", err)
+ }
}
func dbConn() (db *sql.DB) {
diff --git a/instrumentation/opencensus/init.go b/instrumentation/opencensus/init.go
index 818306a..96c347b 100644
--- a/instrumentation/opencensus/init.go
+++ b/instrumentation/opencensus/init.go
@@ -21,7 +21,9 @@ func Init(cfg *config.AgentConfig) func() {
client := &http.Client{Transport: &http.Transport{
TLSClientConfig: &tls.Config{
- MinVersion: tls.VersionTLS12,
+ MinVersion: tls.VersionTLS12,
+ // Ignore gosec: G402 (CWE-295): TLS InsecureSkipVerify may be true.
+ // #nosec G402
InsecureSkipVerify: !cfg.GetReporting().GetSecure().GetValue(),
},
}}
diff --git a/instrumentation/opentelemetry/github.com/jackc/hyperpgx/pgx.go b/instrumentation/opentelemetry/github.com/jackc/hyperpgx/pgx.go
index 9443d9d..b67fdd1 100644
--- a/instrumentation/opentelemetry/github.com/jackc/hyperpgx/pgx.go
+++ b/instrumentation/opentelemetry/github.com/jackc/hyperpgx/pgx.go
@@ -8,7 +8,7 @@ import (
"github.com/hypertrace/goagent/sdk"
"github.com/jackc/pgconn"
"github.com/jackc/pgtype/pgxtype"
- "github.com/jackc/pgx/v4"
+ pgx "github.com/jackc/pgx/v4"
)
var _ PGXConn = (*pgx.Conn)(nil)
diff --git a/sdk/instrumentation/net/http/attributes.go b/sdk/instrumentation/net/http/attributes.go
index 4a838ef..fc44b35 100644
--- a/sdk/instrumentation/net/http/attributes.go
+++ b/sdk/instrumentation/net/http/attributes.go
@@ -2,6 +2,7 @@ package http // import "github.com/hypertrace/goagent/sdk/instrumentation/net/ht
import (
"fmt"
+ "log"
"strings"
"github.com/hypertrace/goagent/sdk"
@@ -9,7 +10,7 @@ import (
// SetAttributesFromHeaders set attributes into span from a HeaderAccessor
func SetAttributesFromHeaders(_type string, headers HeaderAccessor, span sdk.Span) {
- headers.ForEachHeader(func(key string, values []string) error {
+ err := headers.ForEachHeader(func(key string, values []string) error {
if len(values) == 1 {
span.SetAttribute(
fmt.Sprintf("http.%s.header.%s", _type, strings.ToLower(key)),
@@ -26,4 +27,8 @@ func SetAttributesFromHeaders(_type string, headers HeaderAccessor, span sdk.Spa
}
return nil
})
+
+ if err != nil {
+ log.Printf("error occurred while setting attributes from headers: %v\n", err)
+ }
}