a9b0ef0a11
chore(deps): update all dependencies ( #822 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-06-13 19:48:12 +02:00
9c19cb6501
Add check for usage of Rat.SetString in math/big with an overflow error ( #819 )
...
* Add check for usage of Rat.SetString in math/big with an overflow error
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7
has an overflow that can lead to Uncontrolled Memory Consumption.
It is the CVE-2022-23772.
* Use ContainsPkgCallExpr instead of manual parsing
2022-06-03 00:19:51 +02:00
fb587c1d10
Remove additional --update for apk in Dockerfile ( #818 )
...
There is no need to use --update with --no-cache when using apk on
Alpine Linux, as using --no-cache will fetch the index every time and
leave no local cache, so the index will always be the latest without
temporary files remain in the image.
2022-05-31 15:06:52 +02:00
c3ede62822
Update x/tools to pick up fix for golang/go#51629 ( #817 )
2022-05-29 17:41:10 +02:00
0a929c7b6c
chore(deps): update all dependencies ( #816 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-05-29 17:36:29 +02:00
12be14859b
chore(deps): update all dependencies ( #812 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-05-09 12:02:57 +02:00
0dcc3362ae
chore(deps): update all dependencies ( #811 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-05-02 21:00:33 +02:00
34d144b3fa
Add new rule for Slowloris Attack
2022-04-30 12:38:50 +02:00
a64cde55a4
Fix the dependencies after renovate upate ( #806 )
2022-04-11 20:21:09 +02:00
b69c3d48c8
chore(deps): update all dependencies ( #805 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-04-11 20:12:37 +02:00
89dfdc0c97
Update the description message of template rule ( #803 )
2022-04-05 07:41:36 +02:00
0791d31471
Fix typo in ReadMe ( #802 )
2022-04-05 07:15:22 +02:00
2ef1d9a037
Fix build after renovate update ( #800 )
2022-03-28 20:38:14 +02:00
afc9903ba9
Fix use rule IDs to retrieve the rule config
2022-03-28 20:28:02 +02:00
82eaa12696
chore(deps): update all dependencies ( #796 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-03-28 20:23:59 +02:00
607d607b51
Enable Go 1.18 in the ci and release workflows
...
* Enable Go 1.18 in the ci and release workflows
* Fix lint warning
* Add golangci as a make target
2022-03-21 16:53:22 +01:00
b99b5f7838
Fix the lint action after upgrade ( #790 )
2022-03-14 14:19:29 +01:00
8af0af7611
chore(deps): update all dependencies ( #789 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-03-14 14:10:28 +01:00
ea5d31f7f5
Add a recursive flag -r to skip specifying ./... path
...
* added recursive flag to skip specifying ./... path
* refactored to remove code duplication
2022-03-07 10:31:22 +01:00
48bbf96b56
Adds directory traversal for Http.Dir("/")
2022-03-06 10:58:47 +01:00
26f10e0a7a
Extend the release action to sign the docker image and binary files with cosign ( #781 )
...
* Extend the release action to sign the docker image and binary files with cosign
* Fix lint warnings
* Fix the ling warnings
* Fix the lint warnings
2022-02-22 21:33:42 +01:00
7d539ed494
feat: add concurrency option to parallelize package loading ( #778 )
...
* feat: add concurrency option to parallelize package loading
* refactor: move wg.add inside the for loop
* fix: gracefully stop the workers on error
* test: add test for concurrent scan
2022-02-16 18:23:37 +01:00
43577cebb7
chore(deps): update all dependencies
2022-02-16 12:21:25 +01:00
c0680bb6a3
Process the code snippet before adding it to the SARIF report
...
Preprocess the code snippet from the issue in order to extract only the line(s)
of code where the issue is located. In addition remove the line numbers and whitespaces
before writing the code snippet into the SARIF report.
2022-02-09 16:19:40 +01:00
db8d98b571
Updated sponsor link in README.md
...
- Because of rebranding (Daimler AG has become
Mercedes-Benz Group AG) the github organization has
been renamed as well.
- Updated sponsorship link in README.md to new github organization
2022-02-07 10:34:42 +01:00
507f8472ca
chore(deps): update golang.org/x/crypto commit hash to 30dcbda
2022-02-07 10:34:16 +01:00
853e1d5034
chore(deps): update all dependencies
2022-01-31 18:58:38 +01:00
09a2941ad4
Use the CWE name as a name in the SARIF report
2022-01-27 15:51:51 +01:00
9399e7bed7
chore(deps): update all dependencies ( #771 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-01-27 11:26:33 +10:00
2fad8a4193
Resolve the TLS min version when is declarted in the same package but in a different file
2022-01-26 19:27:26 +01:00
1fbcf10e18
Add a test for tls min version defined in a different file
2022-01-26 19:27:26 +01:00
b12c0f6e4e
chore(deps): update all dependencies ( #765 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-01-26 11:10:11 +01:00
1d909e2687
Add db.Exec and db.Prepare to the sql rule ( #763 )
...
* Add db.Exec and db.Prepare to the sql rule
* add test cases for G201,G202
2022-01-17 13:50:37 +01:00
742aa848f9
chore(deps): update golang.org/x/crypto commit hash to 5e0467b ( #764 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-01-17 12:42:54 +01:00
7be6d4efb5
Add os.Create to the readfile rule ( #761 )
2022-01-12 19:33:17 +01:00
75cc7dcd51
Fix false negative for SQL injection when using DB.QueryRow.Scan() ( #759 )
2022-01-12 16:33:39 +01:00
58058af0c8
chore(deps): update dependency highlight.js to v11.4.0 ( #758 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2022-01-10 10:56:36 +01:00
9d66b0d346
Fix false negatives for SQL injection in multi-line queries
2022-01-05 12:05:53 +01:00
4c1afaa492
Find G303 with filepath.Join'd temp dirs ( #754 )
2022-01-04 14:48:02 +01:00
19bda8d15f
Find more tempdirs
...
* Find G303 in string concatenations, with os.TempDir, and in path.Join args
* Find G303 with /usr/tmp, too
/usr/tmp is commonly found e.g. on Solaris.
2022-01-03 21:58:25 +01:00
827fca9a83
build(fmt): use [ instead of [[ ( #751 )
...
When `/bin/sh` is not a shell having `[[`, `make fmt` fails:
```
FORMATTING
/bin/sh: 1: [[: not found
```
2022-01-03 20:26:14 +01:00
ad5d74d5a1
Update to ginkgo v2 ( #753 )
2022-01-03 18:11:35 +01:00
72f1145f8a
Fix #743 ( #748 )
...
* Check if nosec tag is in front of a line
* Use \n instead of a whitespace in a test case
2022-01-03 16:48:42 +01:00
63a8e789a1
Handle nil when looking up a file by position into a package ( #747 )
2021-12-22 17:50:46 +01:00
3038a30e3c
Add in the config file settings for exclude and include options
...
Co-authored-by: kaiili <kaii@openingsource.org >
2021-12-20 23:43:50 +01:00
bf0dd2fdd3
chore(deps): update golang.org/x/crypto commit hash to e495a2d ( #745 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com >
2021-12-20 23:36:02 +01:00
2d1c1a6df7
Track both #nosec and #nosec rulelist for one violation ( #741 )
2021-12-20 23:33:01 +01:00
e0f354aa0d
Add the sponsors section in the README file ( #740 )
2021-12-15 20:10:40 +01:00
d23ab2d997
Remove space between // and #nosec in examples and internal use
...
Comments intended for machines to read do not have the space by
convention.
2021-12-15 19:31:14 +01:00
35af340d07
Fix #736 ( #738 )
2021-12-13 17:45:47 +01:00
