Commit Graph
21 Commits
Author SHA1 Message Date
oittaa a631af86ec Fix URL regexp and remove redundant Google regex patterns (#1485) 2026-01-28 10:28:52 +01:00
oittaa 89685023f9 feat: implement global cache usage in rules (#1480)
* feat: implement global cache usage in rules

* refactor: make global cache generic with local key types

- Remove GlobalKey struct from gosec_cache.go
- Each use case now defines its own key type (type safety via Go's type system)
- Move RegexMatchWithCache to separate regex_cache.go file
- Move cache kind constants to rules/hardcoded_credentials.go as local types
- Add documentation for cache key requirements
2026-01-26 13:29:03 +01:00
oittaa ade0e8f432 refactor: optimize nosec parsing and reduce allocations (#1478)
- Replace dynamic fmt.Errorf with static errors in hot paths
- Replace regex-based directive parsing with manual string parsing (removed regexp import)
- Use const for directive prefix
2026-01-25 12:35:59 +01:00
oittaa 15cba7fae1 feat: optimize GetCallInfo with per-package sync.Pool caching (#1481) 2026-01-23 11:27:37 +01:00
oittaa 5288673473 feat: implement entropy pre-filtering to optimize secret detection (#1479) 2026-01-23 11:25:02 +01:00
oittaa d9a9bcd45c feat: ensure GoVersion is cached using sync.Once (#1477) 2026-01-23 11:23:34 +01:00
oittaa bd3c738bf0 G115: Enhance RangeAnalyzer with constant propagation and chained arithmetic support (#1470)
* G115: Enhance RangeAnalyzer with constant propagation and chained arithmetic support

* Fix G115 overflow detection for negated values and robustify RangeAnalyzer propagation
2026-01-19 17:56:26 +01:00
oittaa 726d847c79 Optimize analyzer with parallel package processing (#1466)
- Memory optimization
- Public API compatibility
- Stateless private functions
2026-01-14 16:37:18 +01:00
oittaa 7284e15230 Refactor Analyzers: Unify Range Logic & Optimize Allocations (#1464)
* refactor

* optimizations

* Refactor analyzers: unify range logic and optimize allocations- Centralize numeric range analysis in util.go (shared by G115/G602).- Implement object pooling for slice_bounds and hardcoded_nonce.- Update conversion_overflow tests to use real analyzer logic.

* Refactor RangeAnalyzer
2026-01-14 10:52:35 +01:00
oittaa 7a4ccefd88 Optimize G115, G602, G407 analyzers to reduce allocations and memory (#1463)
* Optimize G115, G602, G407 analyzers to reduce allocations and memory

* improve G407 coverage
2026-01-13 19:00:33 +01:00
oittaa 833d7919e0 refactor(g115): improve coverage (#1462) 2026-01-12 11:37:18 +01:00
oittaa 0cc9e01a9d Refine G407 to improve detection and coverage of hardcoded nonces (#1460)
* Refine G407 to improve detection and coverage of hardcoded nonces

* chore: consolidate common analyzer patterns into util.go and improve G602 coverage

* Optimize G602 and G115 with state caching and regex pre-compilation

* Improve G115 overflow detection and fix false positives and false negatives

* golangci-lint workaround
2026-01-12 09:56:55 +01:00
oittaa 7387d22592 Refactor rules to use callListRule base structure (#1458)
* Refactor rules to utilize callListRule base structure

- Introduced a new base structure `callListRule` in `rules/base.go` to standardize the implementation of rules that check for specific function calls.
- Updated existing rules to inherit from `callListRule`, simplifying their structure and removing redundant ID methods.
- Modified the `MetaData` field to use `RuleID` instead of `ID` for consistency across rules.
- Removed the `weakcryptohash.go` and `weakdepricatedcryptohash.go` files as their functionality has been integrated into the new structure.

* fix(tlsconfig): correct MetaData field name in generated TLS check

* refactor: standardize rule metadata and call list initialization
2026-01-09 13:55:35 +01:00
oittaa 52f5dbf4d4 feat(slice): enhance slice bounds analysis with dynamic bounds handling (#1457)
* feat(slice): enhance slice bounds analysis with dynamic bounds handling

* feat(slice): enhance extractLenBound to support additional offset patterns and improve slice bounds analysis

* golangci-lint run

* Improve G602 slice bounds detection: support 3-index slices and correct capacity tracking

* Support out-of-bounds detection for range loops with offsets
2026-01-09 13:52:05 +01:00
oittaaandCosmin Cojocar 649e2c8da4 remove deprecated ast.Object (#1455)
* remove deprecated ast.Object

* feat(tls): enhance TLS configuration handling with new checks for InsecureSkipVerify and PreferServerCipherSuites

---------

Co-authored-by: Cosmin Cojocar <cosmin@cojocar.ch>
2026-01-06 14:44:42 +01:00
oittaa 35a92b49d5 feat(sql): enhance SQL injection detection with improved string concatenation checks (#1454)
* feat(sql): enhance SQL injection detection with improved string concatenation checks

* optimize: only one ast.Inspect loop, use slices.ContainsFunc

* refactor(sql): streamline SQL argument retrieval, replace constObject with TryResolve, minor cleanup

* feat(sql): enhance query mutation checks for shadowed variables and add regression tests

* remove deprecated ast.Object
2026-01-06 14:30:54 +01:00
oittaa bc9d2bc879 feat(rules): enhance subprocess variable checks (#1453)
* feat(rules): enhance subprocess variable checks

* ast.Object is deprecated
2026-01-06 14:20:23 +01:00
oittaa 8a5404eabf feat(resolve): enhance TryResolve to handle KeyValueExpr, IndexExpr, and SliceExpr (#1452)
* feat(resolve): enhance TryResolve to handle KeyValueExpr, IndexExpr, and SliceExpr

* golangci-lint
2026-01-04 17:22:20 +02:00
oittaa 0f6f21cb3f feat: add secrets serialization G117 (#1451)
* Rule to detect secrets serialization

* Add G117 to rules_test.go

* Fix false positives

* Map to CWE 499, update README
2026-01-04 17:21:22 +02:00
oittaa 717706e815 feat(rules): add support for detecting high entropy strings in composite literals (#1447) 2026-01-02 09:58:08 +02:00
oittaa 082deb6cee whitelist crypto/rand Read from error checks (#1446) 2025-12-31 18:57:36 +02:00