G117 now skips findings when:
- The marshal call is inside a custom marshaler method (MarshalJSON, MarshalYAML, etc.)
- The type being marshaled implements a custom marshaler interface
- A composite literal wraps the sensitive field value in a function call (e.g. mask())
Also fixes the issue message to show the correct format name (JSON/YAML/XML/TOML)
instead of always saying "JSON key".
Closes#1614
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: implement global cache usage in rules
* refactor: make global cache generic with local key types
- Remove GlobalKey struct from gosec_cache.go
- Each use case now defines its own key type (type safety via Go's type system)
- Move RegexMatchWithCache to separate regex_cache.go file
- Move cache kind constants to rules/hardcoded_credentials.go as local types
- Add documentation for cache key requirements
* Refine G407 to improve detection and coverage of hardcoded nonces
* chore: consolidate common analyzer patterns into util.go and improve G602 coverage
* Optimize G602 and G115 with state caching and regex pre-compilation
* Improve G115 overflow detection and fix false positives and false negatives
* golangci-lint workaround
* Refactor rules to utilize callListRule base structure
- Introduced a new base structure `callListRule` in `rules/base.go` to standardize the implementation of rules that check for specific function calls.
- Updated existing rules to inherit from `callListRule`, simplifying their structure and removing redundant ID methods.
- Modified the `MetaData` field to use `RuleID` instead of `ID` for consistency across rules.
- Removed the `weakcryptohash.go` and `weakdepricatedcryptohash.go` files as their functionality has been integrated into the new structure.
* fix(tlsconfig): correct MetaData field name in generated TLS check
* refactor: standardize rule metadata and call list initialization
* Removed old way of initializing analyzers
* Added the new analyzer to the rest of the default analyzers
* Fixed small bug in the rule
* Removed the test for the new analyzer from the file responsible for testing the rules
* Merged the diffrent examples into 1 variable
* Added tests for the analyzer
* Removed code that was used for testing rules, but it was used to test the analyzer
The rule is supposed to detect for the usage of hardcoded or static nonce/Iv in many encryption algorithms:
* The different modes of AES (mainly tested here)
* It should be able to work with ascon
Currently the rules doesn't check when constant variables are used.
TODO: Improve the rule, to detected for constatant variable usage
* This change does not exclude analyzers for inline comment
* Changed the expected issues count for G103, G109 samples for test. Previously G115 has been included in the issue count
* Show analyzers IDs(G115, G602) in gosec usage help
* See #1175
* Rule G406 responsible for the usage of deprecated MD4 and RIPEMD160 added.
* Rules G506, G507 responsible for tracking the usage of the already mentioned libraries added.
* Slight changes in the Makefile(`make clean` wasn't removing all expected files)
* Added license to `analyzer_test.go`
Now the G401 rule is split into hashing and encryption algorithms.
G401 is responsible for checking the usage of MD5 and SHA1, with corresponding CWE of 328.
And G405(New rule) is responsible for checking the usege of DES and RC4, with corresponding CWE of 327.
Add additional types such as CSS, JSStr and Srcset to the template rule.
These types are marked as a security risk in the godoc
https://pkg.go.dev/html/template.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
It seems that the os.Create will create by default a file with 0666 permissions.
This should be detected when the configured permissions are less than 0666. By default will not detect this case
unless the more restrictive mode is configured.
Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
Cosmin Cojocar
oittaa
kfessandCosmin Cojocar
Eshani Parulekar
Oleksandr Redko
Ilia Mirkin
Brandon AnninandccoVeille
Dimitar Banchev
Rahul Gadi
Hiroki Yorimitsu
Cosmin Cojocar
Janusz Marcinkiewicz
Quentin Laplanche