semgrep.yml

# Copyright (C) 2025 l3montree GmbH
# 
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
# 
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
# 
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.

rules:
  - id: missing-error-message
    languages:
      - go
    severity: ERROR
    message: |
      Missing error message or forwarded error message from internal error. Use: echo.NewHTTPError(..., "...").
      Do not concatenate the error message directly. Use fmt.Sprintf(...) instead. For example: echo.NewHTTPError(400, fmt.Sprintf("could not process request: %s", err.Error()))
    patterns:
      - pattern: echo.NewHTTPError(...)
      - pattern-not: echo.NewHTTPError(..., "...")
      - pattern-not: echo.NewHTTPError(..., fmt.Sprintf(...))
  - id: no-internal-error
    languages:
      - go
    severity: ERROR
    message: |
      Provide internal error for better logging. Use: echo.NewHTTPError(...).WithInternal(err)
    patterns:
      - pattern: echo.NewHTTPError(500)
      - pattern-not-inside: |
          echo.NewHTTPError(500).WithInternal(...)

  - id: repo-method-missing-ctx
    message: Repository method should have ctx context.Context as first parameter
    severity: WARNING
    languages: [go]
    paths:
      include:
        - "**/database/repositories/**"
    patterns:
      - pattern: func ($R $T) $METHOD(...) { ... }
      - pattern-not: func ($R $T) $METHOD(ctx context.Context, ...) { ... }
    fix-regex:
      regex: '(\) \w+\()(?!\))'
      replacement: '\1ctx context.Context, '
      count: 1

  - id: repo-method-missing-ctx-empty-params
    message: Repository method should have ctx context.Context as first parameter
    severity: WARNING
    languages: [go]
    paths:
      include:
        - "**/database/repositories/**"
    patterns:
      - pattern: func ($R $T) $METHOD() { ... }
    fix-regex:
      regex: '(\) \w+\()\)'
      replacement: '\1ctx context.Context)'
      count: 1

  - id: repo-direct-db-access
    message: Use GetDB(ctx, tx) instead of accessing the db field directly
    severity: WARNING
    languages: [go]
    paths:
      include:
        - "**/database/repositories/**"
      exclude:
        - "**/database/repositories/gorm_repository.go"
    patterns:
      - pattern: $R.db
      - pattern-not-inside: func ($R $T) GetDB(...) { ... }

  - id: repo-getdb-nil-when-tx-available
    message: tx is available as parameter, use GetDB(ctx, tx) instead of GetDB(ctx, nil)
    severity: WARNING
    languages: [go]
    paths:
      include:
        - "**/database/repositories/**"
    patterns:
      - pattern-inside: func ($RECV $TYPE) $METHOD(ctx context.Context, tx *gorm.DB, ...) { ... }
      - pattern: $R.GetDB(ctx, nil)

  - id: repo-method-missing-tx
    message: Repository method should have tx *gorm.DB as second parameter after ctx
    severity: WARNING
    languages: [go]
    paths:
      include:
        - "**/database/repositories/**"
      exclude:
        - "**/database/repositories/gorm_repository.go"
    patterns:
      - pattern: func ($R $T) $METHOD(ctx context.Context, $A $B, ...) { ... }
      - pattern-not: func ($R $T) $METHOD(ctx context.Context, tx *gorm.DB, ...) { ... }

  - id: service-method-missing-ctx
    message: Service method should have ctx context.Context as first parameter
    severity: WARNING
    languages: [go]
    paths:
      include:
        - "**/services/**"
    patterns:
      - pattern: func ($R $T) $METHOD(...) { ... }
      - pattern-not: func ($R $T) $METHOD(ctx context.Context, ...) { ... }
      - pattern-not: func ($R $T) $METHOD($C echo.Context, ...) { ... }
      - pattern-not: func ($R $T) $METHOD($C shared.Context, ...) { ... }

  - id: service-method-missing-ctx-empty-params
    message: Service method should have ctx context.Context as first parameter
    severity: WARNING
    languages: [go]
    paths:
      include:
        - "**/services/**"
    patterns:
      - pattern: func ($R $T) $METHOD() { ... }

  - id: repo-method-missing-tx-only-ctx
    message: Repository method should have tx *gorm.DB as second parameter after ctx
    severity: WARNING
    languages: [go]
    paths:
      include:
        - "**/database/repositories/**"
      exclude:
        - "**/database/repositories/gorm_repository.go"
    patterns:
      - pattern: func ($R $T) $METHOD(ctx context.Context) { ... }
      - pattern-not: func ($R $T) Begin(ctx context.Context) { ... }

  - id: tx-begin-without-defer-rollback
    message: |
      db.Begin() called without defer tx.Rollback(). Leaked transactions hold locks.
      Use: tx := db.Begin(); defer tx.Rollback(); ... ; tx.Commit()
    severity: ERROR
    languages: [go]
    patterns:
      - pattern: $TX := $DB.Begin()
      - pattern-not-inside: |
          ...
          defer $TX.Rollback()
          ...

  - id: tx-begin-without-commit
    message: |
      db.Begin() called but tx.Commit() is never called in this function.
      The transaction will always be rolled back.
    severity: ERROR
    languages: [go]
    patterns:
      - pattern: |
          $TX := $DB.Begin()
          ...
      - pattern-not-inside: |
          ...
          $TX.Commit()
          ...

  - id: context-background-when-ctx-available
    message: |
      context.Background() / context.TODO() used inside a function that already receives a context parameter.
      Reuse the passed-in context to propagate tracing and cancellation signals instead of starting a new root context.
    severity: WARNING
    languages: [go]
    paths:
      exclude:
        - "**/*_test.go"
        - "**/tests/**"
        - "**/cmd/**"
    patterns:
      - pattern-either:
          - pattern-inside: |
              func $NAME(..., $CTX context.Context, ...) $RET {
                ...
              }
          - pattern-inside: |
              func ($RECV $TYPE) $NAME(..., $CTX context.Context, ...) $RET {
                ...
              }
          - pattern-inside: |
              func $NAME(..., $C echo.Context, ...) $RET {
                ...
              }
          - pattern-inside: |
              func ($RECV $TYPE) $NAME(..., $C echo.Context, ...) $RET {
                ...
              }
      - pattern-not-inside: trace.ContextWithSpan(context.Background(), ...)
      - pattern-either:
          - pattern: context.Background()
          - pattern: context.TODO()