From 475a4912d19d68ba5d0a28ffa75ae31ab7640d13 Mon Sep 17 00:00:00 2001
From: k4yt3x <i@k4yt3x.com>
Date: Wed, 4 Sep 2024 00:33:53 +0000
Subject: [PATCH] ci(sast): fixed SAST tool warnings

Signed-off-by: k4yt3x <i@k4yt3x.com>
---
 CHANGELOG.md             |  1 +
 cmd/autobump/git_test.go | 24 +++++++++++++++++++++---
 horusec.json             | 14 ++++++++++++--
 3 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 689340b..6ef1e77 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,6 +30,7 @@ Exceptions are acceptable depending on the circumstances (critical bug fixes tha
 
 ### Fixed
 
+- fixed SAST tool warnings
 - fixed a typo in authentication method selection
 
 ## [2.14.0] - 2024-03-01
diff --git a/cmd/autobump/git_test.go b/cmd/autobump/git_test.go
index 3c3fc8c..076d507 100644
--- a/cmd/autobump/git_test.go
+++ b/cmd/autobump/git_test.go
@@ -1,14 +1,16 @@
 package main
 
 import (
+	"crypto/rand"
 	"fmt"
-	"math/rand"
+	"math/big"
 	"testing"
 
 	"github.com/go-faker/faker/v4"
 	"github.com/go-git/go-billy/v5/memfs"
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/config"
+	"github.com/go-git/go-git/v5/plumbing/object"
 	"github.com/go-git/go-git/v5/plumbing/transport/http"
 	"github.com/go-git/go-git/v5/storage/memory"
 	"github.com/stretchr/testify/assert"
@@ -147,6 +149,10 @@ func TestGetLatestTag_Success(t *testing.T) {
 
 	// Commit the changes
 	_, err = wt.Commit(faker.Sentence(), &git.CommitOptions{
+		Author: &object.Signature{
+			Name:  faker.Name(),
+			Email: faker.Email(),
+		},
 		All: true,
 	})
 	require.NoError(t, err)
@@ -155,8 +161,16 @@ func TestGetLatestTag_Success(t *testing.T) {
 	head, err := repo.Head()
 	require.NoError(t, err)
 
-	// Create a tag on the commit
-	testTag := fmt.Sprintf("%d.%d.%d", rand.Intn(10), rand.Intn(10), rand.Intn(10))
+	// Create a random tag on the commit
+	randMax := big.NewInt(10)
+	major, err := rand.Int(rand.Reader, randMax)
+	require.NoError(t, err)
+	minor, err := rand.Int(rand.Reader, randMax)
+	require.NoError(t, err)
+	patch, err := rand.Int(rand.Reader, randMax)
+	require.NoError(t, err)
+
+	testTag := fmt.Sprintf("%d.%d.%d", major, minor, patch)
 	_, err = repo.CreateTag(testTag, head.Hash(), nil)
 	require.NoError(t, err)
 
@@ -195,6 +209,10 @@ func TestGetLatestTag_NoTagsFound(t *testing.T) {
 
 	// Commit the changes
 	_, err = wt.Commit("initial commit", &git.CommitOptions{
+		Author: &object.Signature{
+			Name:  faker.Name(),
+			Email: faker.Email(),
+		},
 		All: true,
 	})
 	require.NoError(t, err)
diff --git a/horusec.json b/horusec.json
index 21da9ea..7f33ae7 100644
--- a/horusec.json
+++ b/horusec.json
@@ -1,4 +1,14 @@
 {
-  "horusecCliFalsePositiveHashes": [],
-  "horusecCliRiskAcceptHashes": []
+  "horusecCliFalsePositiveHashes": [
+    "e56f980ae1b2ef6b01c86f493be3cc5c374bdc550acdc5d1eb9d152419578b9d"
+  ],
+  "horusecCliRiskAcceptHashes": [
+    "560ba363f658af6c83e47bb0109356868c073a9c0fed0e4f7c6b633bf7ce77b5",
+    "dfb23abce8d2f48ffecebf436cf7cee39387c5d90882f2788830d7dd4d6054cd",
+    "7b5c7b22ecf9ab317402793b0705e0a82f669bf7bc640e1d6fcbbcdef0f3102f",
+    "ddc0ef41bbeeb7556c55f7a0c64ee20d919ca2e380f7e85fa5374c58dc877e73",
+    "282e477e1f992ca495bf244a7eff533d539e6bbb2e93c1874cfb79c4ef9e8682",
+    "db01586a8bf00075b621deb2123ca082fc576afb5c0528fddf774a13cd6a42ca",
+    "391bfdf65c05a160475a7665846c3ae9f3068cadfddcf2a44bde034bb2038ee0"
+  ]
 }