Introduces new G120 to detect potential memory-exhaustion paths caused
by unbounded form parsing in HTTP handlers.
Uses a pure SSA implementation (no AST fallback), checking ParseForm,
ParseMultipartForm, FormValue, and PostFormValue on *http.Request.
Suppresses findings when request bodies are explicitly bounded with
http.MaxBytesReader.
Wires G120 into analyzer registration, README rule catalog, and CWE
mapping (CWE-400).
Adds focused vulnerable/safe samples and analyzer test coverage;
analyzer tests and lint pass.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Add G118 SSA analyzer for context propagation failures that can cause goroutine/resource leaks
This PR introduces G118, a new SSA-based gosec rule that detects
high-risk context misuse patterns: goroutines using
context.Background/TODO when request context exists, missing cancel()
calls from WithCancel/WithTimeout/WithDeadline, and unbounded blocking
loop regions without ctx.Done() guards.
These patterns can leak goroutines and I/O resources, leading to
resource exhaustion/DoS in production services.
The rule is mapped to CWE-400, integrated into analyzer registration and
docs, and includes positive/negative samples (including complex loop CFG
cases) to reduce false positives while preserving detection quality.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Fix false pasitive
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
---------
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Add G408: SSH PublicKeyCallback Authentication Bypass Analyzer
Implements a new SSA-based security analyzer (G408) that detects
stateful misuse of ssh.PublicKeyCallback in SSH server configurations.
This vulnerability can lead to authentication bypass where a server
authenticates one SSH key but performs authorization checks on a
different key.
This addresses a critical security vulnerability (CVE-2024-45337, CVSS
9.1) that has affected production systems including Kubernetes and other
SSH-based services. The vulnerability occurs when developers incorrectly
capture and modify state within PublicKeyCallback closures, enabling
attackers to authenticate with one key while the server operates on
another key's credentials.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Fix tests
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
---------
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Refactor rules to utilize callListRule base structure
- Introduced a new base structure `callListRule` in `rules/base.go` to standardize the implementation of rules that check for specific function calls.
- Updated existing rules to inherit from `callListRule`, simplifying their structure and removing redundant ID methods.
- Modified the `MetaData` field to use `RuleID` instead of `ID` for consistency across rules.
- Removed the `weakcryptohash.go` and `weakdepricatedcryptohash.go` files as their functionality has been integrated into the new structure.
* fix(tlsconfig): correct MetaData field name in generated TLS check
* refactor: standardize rule metadata and call list initialization
The rule is supposed to detect for the usage of hardcoded or static nonce/Iv in many encryption algorithms:
* The different modes of AES (mainly tested here)
* It should be able to work with ascon
Currently the rules doesn't check when constant variables are used.
TODO: Improve the rule, to detected for constatant variable usage
This feature adds support to generate auto fixes for Go scanning findings using LLM (AI). In a first instance, it relies on Gemini API to get a suggestion for a solution. This can be later extended, to integrate also other AI providers.
---------
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
Co-authored-by: ccoVeille <3875889+ccoVeille@users.noreply.github.com>
Co-authored-by: Cosmin Cojocar <ccojocar@google.com>
* Rule G406 responsible for the usage of deprecated MD4 and RIPEMD160 added.
* Rules G506, G507 responsible for tracking the usage of the already mentioned libraries added.
* Slight changes in the Makefile(`make clean` wasn't removing all expected files)
* Added license to `analyzer_test.go`
Now the G401 rule is split into hashing and encryption algorithms.
G401 is responsible for checking the usage of MD5 and SHA1, with corresponding CWE of 328.
And G405(New rule) is responsible for checking the usege of DES and RC4, with corresponding CWE of 327.
Track ignored issues using file location instead of a AST node. There are issues linked to a different AST node than the original node used to start the scan.
Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
* Added slice bounds testing for slice expressions.
* Added checking slice index.
* Added test for reassigning slice.
* Store capacities on reslicing.
* Scope change clears map. Func name used to track slices.
* Map CallExpr to check bounds when passing to functions.
* Fixed linter errors.
* Updated rulelist with CWE mapping.
* Added comment for NewSliceBoundCheck.
* Addressed nil cap runtime error.
* Replaced usage of nil in call arg map with dummy callexprs.
* Updated comments, wrapped error return, addressed other review concerns.
* Remove read only types from unsafe defer rules
* Remove rule G307 which checks when an error is not handled when a file or socket connection is closed
This doesn't seem to bring much value from security perspective, and it caused a lot of controversy since
is a very common pattern in Go.
* Mentioned in documentation that rule G307 is retired
* Clean up the test for rule G307
Cosmin Cojocar
oittaa
kfessandCosmin Cojocar
Brandon AnninandccoVeille
Dimitar Banchev
Cosmin Cojocar
Oleksandr Redko
Morgen Malinoski
Matthieu MOREL