go/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2026-06-20 00:15:59 +02:00
Code Issues Releases Activity

Add G121 analyzer for unsafe CORS bypass patterns in CrossOriginProtection (#1521)

Browse Source 
* Add G121 analyzer for unsafe CORS bypass patterns in CrossOriginProtection

Adds new SSA-only analyzer G121 to detect unsafe usage of
AddInsecureBypassPattern in net/http.CrossOriginProtection.
Flags:
overbroad static bypass patterns (for example /, /*, empty/wildcard-like
values),
request-derived dynamic bypass patterns.
Wires G121 into default analyzer registration, analyzer test suite, CWE
mapping (CWE-346), README rule list, and dedicated sample fixtures.
Includes a narrow lint suppression for a G101 false positive in analyzer
message constants.
Validation: analyzer tests pass and golangci-lint reports 0 issues.

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>

* Ignore false positive warnings

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>

---------

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
This commit is contained in:
Cosmin Cojocar
2026-02-16 15:59:57 +01:00
committed by GitHub
parent 238f982325
commit 36ba72bb7f
6 changed files with 282 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
issue/issue.go
+1
View File
@@ -72,6 +72,7 @@ var ruleToCWE = map[string]string{
"G118": "400",
"G119": "200",
"G120": "400",
"G121": "346",
"G201": "89",
"G202": "89",
"G203": "79",