add rules.go to catch a possible panic

Author: Emyrk

extract/parameter.go

@@ -159,6 +159,7 @@ func ParameterFromBlock(block *terraform.Block) (*types.Parameter, hcl.Diagnosti
 	if ctyType != cty.NilType && pVal.Value.Type().Equals(cty.String) {
 		// TODO: Wish we could support more types, but only string types are
 		// allowed.
+		//nolint:gocritic // string type asserted
 		valStr := pVal.Value.AsString()
 		// Apply validations to the parameter value
 		for _, v := range p.Validations {
@@ -328,6 +329,7 @@ func requiredString(block *terraform.Block, key string) (string, *hcl.Diagnostic
 		return "", diag
 	}
 
+	// nolint:gocritic // string type asserted
 	return tyVal.AsString(), nil
 }
 
@@ -400,6 +402,7 @@ func nullableString(block *terraform.Block, key string) *string {
 		return nil
 	}
 
+	//nolint:gocritic // string type asserted
 	str := val.AsString()
 	return &str
 }
@@ -414,6 +417,7 @@ func optionalString(block *terraform.Block, key string) string {
 		return ""
 	}
 
+	//nolint:gocritic // string type asserted
 	return val.AsString()
 }
 

go.mod

@@ -98,6 +98,7 @@ require (
 	github.com/pion/udp v0.1.4 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/quasilyte/go-ruleguard/dsl v0.3.22 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/samber/lo v1.49.1 // indirect

go.sum

@@ -1118,6 +1118,8 @@ github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:Om
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
+github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
+github.com/quasilyte/go-ruleguard/dsl v0.3.22/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=

hclext/merge.go

@@ -1,6 +1,8 @@
 package hclext
 
-import "github.com/zclconf/go-cty/cty"
+import (
+	"github.com/zclconf/go-cty/cty"
+)
 
 func MergeObjects(a, b cty.Value) cty.Value {
 	output := make(map[string]cty.Value)
@@ -9,6 +11,11 @@ func MergeObjects(a, b cty.Value) cty.Value {
 		output[key] = val
 	}
 	b.ForEachElement(func(key, val cty.Value) (stop bool) {
+		// TODO: Should this error be captured?
+		if key.Type() != cty.String {
+			return true
+		}
+		//nolint:gocritic // string type asserted above
 		k := key.AsString()
 		old := output[k]
 		if old.IsKnown() && isNotEmptyObject(old) && isNotEmptyObject(val) {

hclext/references.go

@@ -67,6 +67,7 @@ func CreateDotReferenceFromTraversal(traversals ...hcl.Traversal) string {
 			case hcl.TraverseIndex:
 				switch {
 				case part.Key.Type().Equals(cty.String):
+					//nolint:gocritic // string type asserted above
 					refParts = append(refParts, fmt.Sprintf("[%s]", part.Key.AsString()))
 				case part.Key.Type().Equals(cty.Number):
 					idx, _ := part.Key.AsBigFloat().Int64()

hclext/vartypes.go

@@ -32,6 +32,7 @@ func parameterContextsEvalHook(input Input) func(ctx *tfcontext.Context, blocks
 				continue // Ignore the errors at this point
 			}
 
+			//nolint:gocritic // string type asserted
 			name := nameVal.AsString()
 			var value cty.Value
 			pv, ok := input.RichParameterValue(name)

paramhook.go

@@ -14,3 +14,22 @@
 //
 // Note: don't forget to run `golangci-lint cache clean`!
 package gorules
+
+import "github.com/quasilyte/go-ruleguard/dsl"
+
+// asStringsIsDangerous checks for the use of AsString() on cty.Value.
+// This function can panic if not used correctly, so the cty.Type must be known
+// before calling. Ignore this lint if you are confident in your usage.
+func asStringsIsDangerous(m dsl.Matcher) {
+	m.Import("github.com/zclconf/go-cty/cty")
+
+	m.Match(
+		`$v.AsString()`,
+	).
+		Where(
+			m["v"].Type.Is("cty.Value") &&
+				// Ignore unit tests
+				!m.File().Name.Matches(`_test\.go$`),
+		).
+		Report("'AsStrings()' can result in a panic if the type is not known. Ignore this linter with caution")
+}

scripts/rules.go

@@ -7,6 +7,14 @@ import (
 	"github.com/zclconf/go-cty/cty"
 )
 
+func CtyValueStringDefault(def string, val cty.Value) string {
+	str, err := CtyValueString(val)
+	if err != nil {
+		return def
+	}
+	return str
+}
+
 // CtyValueString converts a cty.Value to a string.
 // It supports only primitive types - bool, number, and string.
 // As a special case, it also supports map[string]interface{} with key "value".
@@ -47,6 +55,7 @@ func CtyValueString(val cty.Value) (string, error) {
 	case cty.Number:
 		return val.AsBigFloat().String(), nil
 	case cty.String:
+		//nolint:gocritic // string type asserted above
 		return val.AsString(), nil
 	// We may also have a map[string]interface{} with key "value".
 	case cty.Map(cty.String):

types/primitive.go

@@ -80,6 +80,7 @@ func (s HCLString) AsString() string {
 	if s.Valid() && s.Value.IsKnown() {
 		switch {
 		case s.Value.Type().Equals(cty.String):
+			//nolint:gocritic // string type asserted
 			return s.Value.AsString()
 		case s.Value.Type().Equals(cty.Number):
 			// TODO: Float vs Int?