Merge pull request #195 from step-security-bot/stepsecurity_remediation_1711216890

[StepSecurity] ci: Harden GitHub Actions

.github/workflows/govulncheck.yml

@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2022 Winni Neessen <winni@neessen.dev>
+#
+# SPDX-License-Identifier: CC0-1.0
+
+name: Govulncheck Security Scan
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps: 
+    - name: Harden Runner
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+      with:
+        egress-policy: audit
+    - name: Run govulncheck
+      uses: golang/govulncheck-action@3a32958c2706f7048305d5a2e53633d7e37e97d0 # v1.0.2

.github/workflows/reuse.yml

@@ -6,6 +6,9 @@ name: REUSE Compliance Check
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/sonarqube.yml

@@ -3,6 +3,10 @@
 # SPDX-License-Identifier: CC0-1.0
 
 name: SonarQube
+
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.gitignore

@@ -55,3 +55,5 @@ com_crashlytics_export_strings.xml
 crashlytics.properties
 crashlytics-build.properties
 fabric.properties
+
+testdata

README.md

@@ -12,6 +12,7 @@ SPDX-License-Identifier: CC0-1.0
 [![Mentioned in Awesome Go](https://awesome.re/mentioned-badge-flat.svg)](https://github.com/avelino/awesome-go)
 [![#go-mail on Discord](https://img.shields.io/badge/Discord-%23go%E2%80%93mail-blue.svg)](https://discord.gg/ysQXkaccXk) 
 [![REUSE status](https://api.reuse.software/badge/github.com/wneessen/go-mail)](https://api.reuse.software/info/github.com/wneessen/go-mail)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8701/badge)](https://www.bestpractices.dev/projects/8701)
 <a href="https://ko-fi.com/D1D24V9IX"><img src="https://uploads-ssl.webflow.com/5c14e387dab576fe667689cf/5cbed8a4ae2b88347c06c923_BuyMeACoffee_blue.png" height="20" alt="buy ma a coffee"></a>
 
 <p align="center"><img src="./assets/gopher2.svg" width="250" alt="go-mail logo"/></p>

b64linebreaker_test.go

@@ -5,6 +5,7 @@
 package mail
 
 import (
+	"bufio"
 	"bytes"
 	"encoding/base64"
 	"fmt"
@@ -461,3 +462,20 @@ func (e errorWriter) Write([]byte) (int, error) {
 func (e errorWriter) Close() error {
 	return fmt.Errorf("supposed to always fail")
 }
+
+func FuzzBase64LineBreaker_Write(f *testing.F) {
+	f.Add([]byte("abc"))
+	f.Add([]byte("def"))
+	f.Add([]uint8{0o0, 0o1, 0o2, 30, 255})
+	buf := bytes.Buffer{}
+	bw := bufio.NewWriter(&buf)
+	f.Fuzz(func(t *testing.T, data []byte) {
+		b := &Base64LineBreaker{out: bw}
+		if _, err := b.Write(data); err != nil {
+			t.Errorf("failed to write to B64LineBreaker: %s", err)
+		}
+		if err := b.Close(); err != nil {
+			t.Errorf("failed to close B64LineBreaker: %s", err)
+		}
+	})
+}

msg_test.go

@@ -3219,3 +3219,31 @@ func TestNewMsgWithNoDefaultUserAgent(t *testing.T) {
 		t.Errorf("WithNoDefaultUserAgent() failed. Expected: %t, got: %t", true, false)
 	}
 }
+
+// Fuzzing tests
+func FuzzMsg_Subject(f *testing.F) {
+	f.Add("Testsubject")
+	f.Add("")
+	f.Add("This is a longer test subject.")
+	f.Add("Let's add some umlauts: üäöß")
+	f.Add("Or even emojis: ☝️💪👍")
+	f.Fuzz(func(t *testing.T, data string) {
+		m := NewMsg()
+		m.Subject(data)
+		m.Reset()
+	})
+}
+
+func FuzzMsg_From(f *testing.F) {
+	f.Add("Toni Tester <toni@tester.com>")
+	f.Add("<tester@example.com>")
+	f.Add("mail@server.com")
+	f.Fuzz(func(t *testing.T, data string) {
+		m := NewMsg()
+		if err := m.From(data); err != nil &&
+			!strings.Contains(err.Error(), "failed to parse mail address") {
+			t.Errorf("failed set set FROM address: %s", err)
+		}
+		m.Reset()
+	})
+}