add gosec action + fix gosec issues

Author: asmyasnikov

.github/workflows/gosec.yml

@@ -0,0 +1,22 @@
+name: gosec
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - master
+      - '**'
+  pull_request:
+  workflow_dispatch:
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    env:
+      GO111MODULE: on
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v2
+      - name: Run Gosec Security Scanner
+        uses: securego/gosec@master
+        with:
+          args: ./...

config/config.go

@@ -300,7 +300,8 @@ func defaults() (c *config) {
 		discoveryInterval: DefaultDiscoveryInterval,
 		balancingConfig:   DefaultBalancer,
 		tlsConfig: &tls.Config{
-			RootCAs: certPool,
+			MinVersion: tls.VersionTLS12,
+			RootCAs:    certPool,
 		},
 	}
 }

internal/driver/cluster/balancer/balancer.go

@@ -2,8 +2,6 @@ package balancer
 
 import (
 	"errors"
-	"math/rand"
-	"time"
 
 	"github.com/ydb-platform/ydb-go-sdk/v3/config"
 	"github.com/ydb-platform/ydb-go-sdk/v3/internal/driver/cluster/balancer/conn"
@@ -48,19 +46,15 @@ type Balancer interface {
 }
 
 func defaultBalancer() Balancer {
-	return &randomChoice{
-		r: rand.New(rand.NewSource(time.Now().UnixNano())),
-	}
+	return &randomChoice{}
 }
 
 func newBalancer(cfg config.BalancerConfig) Balancer {
 	switch cfg.Algorithm {
 	case config.BalancingAlgorithmRoundRobin:
 		return &roundRobin{}
 	case config.BalancingAlgorithmRandomChoice:
-		return &randomChoice{
-			r: rand.New(rand.NewSource(time.Now().UnixNano())),
-		}
+		return &randomChoice{}
 	default:
 		return defaultBalancer()
 	}

internal/driver/cluster/balancer/rr.go

@@ -3,14 +3,14 @@ package balancer
 import (
 	"container/heap"
 	"math"
-	"math/rand"
 	"sync"
 	"sync/atomic"
 
 	"github.com/ydb-platform/ydb-go-sdk/v3/internal/driver/cluster/balancer/conn"
 	"github.com/ydb-platform/ydb-go-sdk/v3/internal/driver/cluster/balancer/conn/info"
 	"github.com/ydb-platform/ydb-go-sdk/v3/internal/driver/cluster/balancer/conn/list"
 	"github.com/ydb-platform/ydb-go-sdk/v3/internal/driver/cluster/balancer/state"
+	"github.com/ydb-platform/ydb-go-sdk/v3/internal/rand"
 )
 
 // roundRobin is an implementation of weighted round-robin balancing algorithm.
@@ -28,7 +28,6 @@ type roundRobin struct {
 
 type randomChoice struct {
 	roundRobin
-	r *rand.Rand // without seed by default
 	m sync.Mutex
 }
 
@@ -46,7 +45,7 @@ func (r *randomChoice) Next() conn.Conn {
 		return nil
 	}
 	r.m.Lock()
-	i := r.belt[r.r.Intn(len(r.belt))]
+	i := r.belt[rand.Int(len(r.belt))]
 	r.m.Unlock()
 	return r.conns[i].Conn
 }

internal/rand/rand.go

@@ -0,0 +1,22 @@
+package rand
+
+import (
+	"crypto/rand"
+	"math/big"
+)
+
+func int64n(max int64) int64 {
+	n, err := rand.Int(rand.Reader, big.NewInt(max))
+	if err != nil {
+		panic(err) // err on negative max
+	}
+	return n.Int64()
+}
+
+func Int64(max int64) int64 {
+	return int64n(max)
+}
+
+func Int(max int) int {
+	return int(int64n(int64(max)))
+}

options.go

@@ -181,7 +181,7 @@ func WithCertificatesFromFile(caFile string) Option {
 			}
 			caFile = filepath.Join(home, caFile[1:])
 		}
-		bytes, err := os.ReadFile(caFile)
+		bytes, err := os.ReadFile(filepath.Clean(caFile))
 		if err != nil {
 			return err
 		}

retry/retry.go

@@ -3,10 +3,10 @@ package retry
 import (
 	"context"
 	"math"
-	"math/rand"
 	"time"
 
 	"github.com/ydb-platform/ydb-go-sdk/v3/internal/errors"
+	"github.com/ydb-platform/ydb-go-sdk/v3/internal/rand"
 	"github.com/ydb-platform/ydb-go-sdk/v3/trace"
 )
 
@@ -155,7 +155,7 @@ func (b logBackoff) delay(i int) time.Duration {
 	if f == d {
 		return f
 	}
-	return f + time.Duration(rand.Intn(int(d-f)+1))
+	return f + time.Duration(rand.Int64(int64(d-f)+1))
 }
 
 func min(a, b uint) uint {

sugar/sugar.go

@@ -6,7 +6,7 @@ import (
 	"path"
 	"strings"
 
-	"github.com/ydb-platform/ydb-go-sdk/v3"
+	ydb "github.com/ydb-platform/ydb-go-sdk/v3"
 	"github.com/ydb-platform/ydb-go-sdk/v3/internal/errors"
 	"github.com/ydb-platform/ydb-go-sdk/v3/scheme"
 	"github.com/ydb-platform/ydb-go-sdk/v3/table"

testutil/session.go

@@ -2,8 +2,10 @@ package testutil
 
 import (
 	"fmt"
-	"math/rand"
+	"math"
 	"strconv"
+
+	"github.com/ydb-platform/ydb-go-sdk/v3/internal/rand"
 )
 
 type (
@@ -23,9 +25,9 @@ func WithServiceID(serviceID uint32) sessionIDOption {
 
 func SessionID(opts ...sessionIDOption) string {
 	h := &sessionIDHolder{
-		serviceID: rand.Uint32(),
-		nodeID:    rand.Uint32(),
-		hash:      strconv.FormatUint(rand.Uint64(), 16),
+		serviceID: uint32(rand.Int64(math.MaxUint32)),
+		nodeID:    uint32(rand.Int64(math.MaxUint32)),
+		hash:      strconv.FormatInt(rand.Int64(math.MaxInt64), 16),
 	}
 	for _, o := range opts {
 		o(h)