Update Github action to use the release of gosec v2.23.0
Change-Id: I72672694bea0a1e25229283e15459f7762965fba
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
* feat: add taint analysis engine for data flow security
Implements SSA-based taint analysis to detect security vulnerabilities:
- G701: SQL injection via string concatenation
- G702: Command injection via user input
- G703: Path traversal via user input
- G704: SSRF via user-controlled URLs
- G705: XSS via unescaped user input
- G706: Log injection via user input
Uses golang.org/x/tools for SSA/call graph analysis with CHA.
Zero external dependencies beyond existing gosec imports.
* feat: implement global cache usage in rules
* refactor: make global cache generic with local key types
- Remove GlobalKey struct from gosec_cache.go
- Each use case now defines its own key type (type safety via Go's type system)
- Move RegexMatchWithCache to separate regex_cache.go file
- Move cache kind constants to rules/hardcoded_credentials.go as local types
- Add documentation for cache key requirements
- Replace dynamic fmt.Errorf with static errors in hot paths
- Replace regex-based directive parsing with manual string parsing (removed regexp import)
- Use const for directive prefix
Add line-based fallback for nosec comment detection when ast.CommentMap
fails to associate comments correctly. This fixes the case where #nosec
comments at the end of lines with open brackets were being ignored.
Refactor duplicate parsing logic into parseNoSecDirective helper function
to reduce code complexity and improve maintainability.
* feat: add debug build profiling support
Add CPU and memory profiling capabilities for debug builds using Go build
tags. Profiling code is completely excluded from release builds.
Changes:
- Add profiling_debug.go with -cpuprofile and -memprofile flags (build tag: debug)
- Add build-debug and build-debug-race Makefile targets
- Refactor main() to run() pattern for proper defer handling
- Replace logger.Fatal() with logger.Printf() + return for clean exits
- Pass logger to profiling for consistent [gosec] log prefix
Usage:
make build-debug
./gosec-debug -cpuprofile cpu.prof -memprofile mem.prof ./...
* Refactor profiling: encapsulate state and improve error handling
- Encapsulate profiling state in Profiler struct to eliminate package-level mutable state
- Add proper error handling with error returns instead of silent failures
- Add exit code constants (exitSuccess/exitFailure) to replace magic numbers
- Fix Makefile clean target to remove gosec-debug binary
- Add nil logger guard for safety
* Use exit constants in all return statements
Replace remaining magic numbers (0, 1) with exitSuccess and exitFailure
constants throughout the run() function for consistency.
---------
Co-authored-by: Oittaa <eero@oittaa.net>
* G115: Enhance RangeAnalyzer with constant propagation and chained arithmetic support
* Fix G115 overflow detection for negated values and robustify RangeAnalyzer propagation
* add path-based rule exclusions
Implements #1287
* Ssupport for excluding specific rules from specific paths, enabling large monorepos to apply different security rules to different components (e.g., CLI tools vs services).
* fix formatting issuue with path filter test to pass gci
* feat: add goanalysis package for nogo
Add goanalysis package providing a standard
golang.org/x/tools/go/analysis.Analyzer for gosec. Enables
integration with nogo, and go vet.
- Implements analysis.Analyzer interface
- Reuses SSA built by analysis framework for efficient caching
- Configurable severity/confidence filtering via flags
- Includes CWE IDs in diagnostics ([CWE-XXX] format)
- Runs both AST rules and SSA analyzers
- Respects #nosec and suppression directives
Also exclude testdata from security scanning in Makefile to
prevent false positives on intentionally vulnerable test files.
* Also exclude testdata from github action
* refactor
* optimizations
* Refactor analyzers: unify range logic and optimize allocations- Centralize numeric range analysis in util.go (shared by G115/G602).- Implement object pooling for slice_bounds and hardcoded_nonce.- Update conversion_overflow tests to use real analyzer logic.
* Refactor RangeAnalyzer
* Refine G407 to improve detection and coverage of hardcoded nonces
* chore: consolidate common analyzer patterns into util.go and improve G602 coverage
* Optimize G602 and G115 with state caching and regex pre-compilation
* Improve G115 overflow detection and fix false positives and false negatives
* golangci-lint workaround
* Refactor rules to utilize callListRule base structure
- Introduced a new base structure `callListRule` in `rules/base.go` to standardize the implementation of rules that check for specific function calls.
- Updated existing rules to inherit from `callListRule`, simplifying their structure and removing redundant ID methods.
- Modified the `MetaData` field to use `RuleID` instead of `ID` for consistency across rules.
- Removed the `weakcryptohash.go` and `weakdepricatedcryptohash.go` files as their functionality has been integrated into the new structure.
* fix(tlsconfig): correct MetaData field name in generated TLS check
* refactor: standardize rule metadata and call list initialization
* feat(slice): enhance slice bounds analysis with dynamic bounds handling
* feat(slice): enhance extractLenBound to support additional offset patterns and improve slice bounds analysis
* golangci-lint run
* Improve G602 slice bounds detection: support 3-index slices and correct capacity tracking
* Support out-of-bounds detection for range loops with offsets
Improve slice bound check to habdle bounded values and properly parse
the address index only from references
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* docs: add documentation for using gosec with private modules
Add a new section in the GitHub Action documentation explaining
how to configure gosec to work with projects that import private
Go modules.
This includes setting `GOPRIVATE` and `GITHUB_AUTHENTICATION_TOKEN`
environment variables.
* Update README.md
Cosmin Cojocar
Ravi Sastry Kadali
renovate[bot]
oittaa
Tom van der Woerdt
Ranyodh Singh