Rule G601 does not recognize a pointer to a struct field

[futuretea]

Summary

Steps to reproduce the behavior

The following code is currently not recognized by Rule G601

package main

import (
	"fmt"
)

type sampleStruct struct {
	name string
}

func main() {
	samples := []sampleStruct{
		{name: "a"},
		{name: "b"},
	}
	for _, sample := range samples {
		fmt.Println(&sample.name)
	}
}

gosec version

master

Go version (output of 'go version')

Operating system / Environment

Expected behavior

For the above code, G601 should prompt a warning

Actual behavior

For the above code, G601 does not have any warning

[ccojocar]

fixed by #967

[AlexanderYastrebov]

I think the change produces false positives for a slice of struct pointers:

$ cat main.go

package main

import (
	"fmt"
)

type sampleStruct struct {
	name string
}

func main() {
	samples := []*sampleStruct{
		{name: "a"},
		{name: "b"},
	}
	for _, sample := range samples {
		fmt.Println(&sample.name)
	}
}

$ go run main.go 
0xc000014270
0xc000014280

$ gosec .
[gosec] 2023/08/18 11:17:57 Including rules: default
[gosec] 2023/08/18 11:17:57 Excluding rules: default
[gosec] 2023/08/18 11:17:57 Import directory: /home/ayastrebov/tmp/gosec966
[gosec] 2023/08/18 11:17:57 Checking package: main
[gosec] 2023/08/18 11:17:57 Checking file: /home/ayastrebov/tmp/gosec966/main.go
Results:


[/home/ayastrebov/tmp/gosec966/main.go:17] - G601 (CWE-118): Implicit memory aliasing in for loop. (Confidence: MEDIUM, Severity: MEDIUM)
    16: 	for _, sample := range samples {
  > 17: 		fmt.Println(&sample.name)
    18: 	}



Summary:
  Gosec  : dev
  Files  : 1
  Lines  : 20
  Nosec  : 0
  Issues : 1

We hit it in zalando/skipper#2521