go/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2026-06-20 00:15:59 +02:00
Code Issues Releases Activity
1,366 Commits 4 Branches 67 Tags
73293bde6b7fdcc006d4586fec9ad7a1d13dccd2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Cosmin Cojocar f9a8bf0152 Update slack badge and link (#905) 2022-12-12 12:20:22 +01:00
Cosmin Cojocar 0acfbb436c Update Go version in CI scripts (#889) 2022-11-08 09:54:40 +01:00
Cosmin Cojocar 1af1d5bb49 Pin release build to Go version 1.19.2 (#882) 2022-10-17 11:06:43 +02:00
Cosmin Cojocar 84661730b0 Update Go version to 1.19 in the makefile (#876) 
Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>

Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
 2022-10-10 09:31:09 +02:00
Cosmin Cojocar 6cd9e6289d Add CWE-676 to cwe mapping (#874) 2022-10-06 08:18:21 +02:00
Cosmin Cojocar 19fa856bad fix: make sure that nil Cwe pointer is handled when getting the CWE ID 2022-08-20 13:32:31 +02:00
Cosmin Cojocar 62fa4b4e9b test: remove white spaces from template 2022-08-20 13:08:50 +02:00
Cosmin Cojocar 074dc71087 fix: handle nil CWE pointer in text template 2022-08-20 13:08:50 +02:00
Cosmin Cojocar a64cde55a4 Fix the dependencies after renovate upate (#806) 2022-04-11 20:21:09 +02:00
Cosmin Cojocar 2ef1d9a037 Fix build after renovate update (#800) 2022-03-28 20:38:14 +02:00
Cosmin Cojocar 607d607b51 Enable Go 1.18 in the ci and release workflows 
* Enable Go 1.18 in the ci and release workflows

* Fix lint warning

* Add golangci as a make target
 2022-03-21 16:53:22 +01:00
Cosmin Cojocar b99b5f7838 Fix the lint action after upgrade (#790) 2022-03-14 14:19:29 +01:00
Cosmin Cojocar 26f10e0a7a Extend the release action to sign the docker image and binary files with cosign (#781) 
* Extend the release action to sign the docker image and binary files with cosign

* Fix lint warnings

* Fix the ling warnings

* Fix the lint warnings
 2022-02-22 21:33:42 +01:00
Cosmin Cojocar c0680bb6a3 Process the code snippet before adding it to the SARIF report 
Preprocess the code snippet from the issue in order to extract only the line(s)
of code where the issue is located.  In addition remove the line numbers and whitespaces
before writing the code snippet into the SARIF report.
 2022-02-09 16:19:40 +01:00
Cosmin Cojocar 09a2941ad4 Use the CWE name as a name in the SARIF report 2022-01-27 15:51:51 +01:00
Cosmin Cojocar 2fad8a4193 Resolve the TLS min version when is declarted in the same package but in a different file 2022-01-26 19:27:26 +01:00
Cosmin Cojocar 1fbcf10e18 Add a test for tls min version defined in a different file 2022-01-26 19:27:26 +01:00
Cosmin Cojocar 7be6d4efb5 Add os.Create to the readfile rule (#761) 2022-01-12 19:33:17 +01:00
Cosmin Cojocar ad5d74d5a1 Update to ginkgo v2 (#753) 2022-01-03 18:11:35 +01:00
Cosmin Cojocar 63a8e789a1 Handle nil when looking up a file by position into a package (#747) 2021-12-22 17:50:46 +01:00
Cosmin Cojocar e0f354aa0d Add the sponsors section in the README file (#740) 2021-12-15 20:10:40 +01:00
Cosmin Cojocar e57efa8482 Fix a panic in suproc rule when the declaration of the variable is not available in the AST (#728) 2021-11-16 21:41:26 +01:00
Cosmin Cojocar 55c6ceaaa6 Fix crash when parsing the TLS min version value (#724) 2021-11-09 21:59:53 +01:00
Cosmin Cojocar 69213955da Fix the SBOM generation step in the release action (#712) 2021-10-15 10:57:09 +02:00
Cosmin Cojocar 5a3a27afae Phase out support for go version 1.15 because current ginko is not backward compatible (#710) 
We are going to support only the stable versions provided by the Go team.
 2021-10-15 10:46:13 +02:00
Cosmin Cojocar 1b2eecc8c4 Enable go 1.17 in the build and release workflows (#694) 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2021-09-02 14:59:49 +02:00
Cosmin Cojocar d3309fb4f5 Add a more generic message for rule g204 (#688) 2021-08-19 15:18:20 +02:00
Cosmin Cojocar f285d612b5 Fix formatting issues with gofumpt (#685) 
Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
 2021-08-18 13:16:21 +02:00
Cosmin Cojocar 3f800cc8ca Fix the unit tests (#652) 
Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
 2021-06-17 14:56:27 +02:00
Cosmin Cojocar df10b65136 Fix gosimple lint warning (#651) 
Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
 2021-06-17 14:39:47 +02:00
Cosmin Cojocar 8a8dbec703 Tidy up the dependencies (#637) 2021-06-01 09:58:09 +02:00
Cosmin Cojocar 0fa5d0b2d6 Fix the go modules after updating to get the tests passing (#605) 
Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
 2021-05-05 16:38:35 +02:00
Cosmin Cojocar 7f2308bd85 Tidy up the moduels after updating (#593) 
Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
 2021-04-01 09:49:25 +02:00
Cosmin Cojocar bf2cd2392b Update all dependencies (#585) 2021-03-01 09:45:00 +01:00
Cosmin Cojocar 9c047e32a3 Add support for Go 1.16 in the CI and release workflows (#581) 
Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
 2021-02-26 11:12:38 +01:00
Cosmin Cojocar dcbcc4dd2a Use a more generic path for sonarqube import path (#573) 
Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
 2021-02-11 14:19:46 +01:00
Cosmin Cojocar 2777e5065e Update README with a note which describes how to import a SonarQube report (#572) 2021-02-11 12:10:44 +01:00
Cosmin Cojocar 897c203e62 Reset the state of TLS rule after each version check (#570) 
Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
 2021-02-11 10:52:16 +01:00
Cosmin Cojocar bcfb27955e Clean up the go module dependncies (#555) 
* Clean up the dependencies

Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>

* Add pq package to dependencies
 2021-01-04 08:41:45 +01:00
Cosmin Cojocar 110b62b05f Add io.CopyBuffer function to rule G110 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-07-29 14:25:45 +02:00
Cosmin Cojocar 6bcd89aa6b Mark all lines of a multi-line finding 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-07-07 10:00:15 +02:00
Cosmin Cojocar 4d4e5949c6 Add some comments 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-07-07 10:00:15 +02:00
Cosmin Cojocar d1467ac998 Extend the code snippet included in the issue and refactored how the code snippet is printed 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-07-07 10:00:15 +02:00
Cosmin Cojocar 37d1af0af3 Expand the arguments to a list of strings when they are provided as a single string 
The GitHub action provide the arguments as a single string to the docker container,
so we need to expand them in order for gosec to properly interpret them.

Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-07-06 19:38:49 +02:00
Cosmin Cojocar ade81d3873 Rename file for consistency 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-06-29 13:52:47 +02:00
Cosmin Cojocar 3784ffea4e Fix panic when reading the version from debug info in Go 1.13 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-06-25 15:27:53 +02:00
Cosmin Cojocar 55d368f2e5 Improve the TLS version checking 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-06-25 09:21:14 +02:00
Cosmin Cojocar ad1cb7e47e Make sure some version information is set when no version was injected into the binary 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-06-25 09:20:55 +02:00
Cosmin Cojocar 1d2c951f2c Extend the rule G304 with os.OpenFile and add a test to cover it 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-06-17 13:14:08 +02:00
Cosmin Cojocar 0c1a71b8a1 Add more tests samples to increase coverage 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-06-15 15:12:02 +02:00
Cosmin Cojocar fe07fcf276 Fix unit test when checking a mix of good and bad random functions 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-06-15 15:12:02 +02:00
Cosmin Cojocar 6bbf8f9cbc Extend the insecure random rule with more insecure random functions 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-06-15 15:12:02 +02:00
Cosmin Cojocar 6a130d55b3 Update the link pointing to issues to CWE mapping to use the master version (#483) 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-05-28 14:40:15 +02:00
Cosmin Cojocar 7da9248ce6 Change the issue test to verify that a multi-line finding contains a line range 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-05-27 10:16:56 +02:00
Cosmin Cojocar 7aedcc56ab Remove print line from tests 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-05-27 10:16:56 +02:00
Cosmin Cojocar 30e93bf865 Improve the SQL strings concat rules to handle multiple string concatenation 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-05-27 10:16:56 +02:00
Cosmin Cojocar 68bce94323 Improve the SQL concatenation and string formatting rules to be applied only in the database/sql context 
In addition makes pattern matching used by the rules cases insensitive.
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-05-27 10:16:56 +02:00
Cosmin Cojocar 32be4a5cc6 Make sure all rules are mapped to CWE numbers 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-05-26 08:59:14 +02:00
Cosmin Cojocar 425b8f9531 Display a sponsor button in the repository 
Enable the funding button in the project following https://help.github.com/en/github/administering-a-repository/displaying-a-sponsor-button-in-your-repository
 2020-05-14 09:33:18 +02:00
Cosmin Cojocar 0714a1e62a Update the users file with some more projects and companies 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-05-12 08:51:13 +02:00
Cosmin Cojocar 1b915ddad7 Set up a gosec's users list 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-05-12 08:51:13 +02:00
Cosmin Cojocar 8662624e28 Update the build badge to ge the status from GitHub workflow 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-20 03:20:30 -07:00
Cosmin Cojocar a5db4e1f04 Run mod tidy to clean up the dependencies 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-20 03:08:39 -07:00
Cosmin Cojocar fb44007c6e Enhance the hardcoded credentials rule to check the equality and non-equality of strings 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-20 03:08:39 -07:00
Cosmin Cojocar a2a40de847 Update the README with an example to configure the hard-coded credentials rule 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-15 07:21:19 -07:00
Cosmin Cojocar 802292c54f Fix the configuration parsing for hardcoded credentials 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-15 07:21:19 -07:00
Cosmin Cojocar c58f3563d3 Set the default color on only for text format 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-14 09:33:44 -07:00
Cosmin Cojocar 1a113d6da9 Turn the color always on when the text format is set 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-14 02:21:37 -07:00
Cosmin Cojocar c4417de46d Use the latest color package to get the color working with tmux 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-14 02:21:37 -07:00
Cosmin Cojocar 51e4317f09 Automate the release process using a GitHub workflow 
The release will trigger when a new tag is pushed.

Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-14 00:41:56 -07:00
Cosmin Cojocar 341059e11a Update the GitHub action name to be more desriptive 2020-04-08 09:40:50 +02:00
Cosmin Cojocar 3b6c3f13f1 Update README with some instruction how to run gosec as a GitHub action 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-08 00:39:01 -07:00
Cosmin Cojocar 08202fee80 Add a GitHub action to run gosec 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-08 00:39:01 -07:00
Cosmin Cojocar c6e10af40f Handle properly the gosec module version v2 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-04-06 09:06:23 -07:00
Cosmin Cojocar e030aa4f76 Remove the go 1.14 version from github action 
It seems to fail when starting the action.

Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-03-30 13:20:59 +02:00
Cosmin Cojocar ee176ff8fc Fix the job names in the Github workflow 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-03-30 13:16:53 +02:00
Cosmin Cojocar cabccc75ef Add to GitHub workflow some jobs for go1.13 and go1.12 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-03-30 13:15:21 +02:00
Cosmin Cojocar a111777041 Change the GitHub workflow to use only the latest Go version 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-03-30 13:06:29 +02:00
Cosmin Cojocar 722acb64cb Change the GitHub workflow to run the builds only on ubuntu-latest platform 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-03-30 12:59:02 +02:00
Cosmin Cojocar 5284f34b6f Change the GitHub workflow to use an action which install Go using a Go version from the matrix 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-03-30 12:52:42 +02:00
Cosmin Cojocar 8de5fb6eb2 Migrate the build to GitHub Actions 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-03-30 03:32:24 -07:00
Cosmin Cojocar 7da9f46445 Fix the call list info to handle selector expressions 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-03-16 09:44:57 +01:00
Cosmin Cojocar cf2590442c Fix the subproc rule to handle correctly the CommandContext check 
In this case, we need to skip the first argument because it is the context.

Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-03-13 13:25:35 +01:00
Cosmin Cojocar f97f86103c Update the subproc rule to detect the syscall.ForkExec and syscall.StartProces calls 
Also add the corresponding tests for this.

Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-03-13 13:25:35 +01:00
Cosmin Cojocar 17df5b3702 Fix typos 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-01-29 09:41:46 +01:00
Cosmin Cojocar 3e069e7756 Fix the errors rule whitelist to work on types methods 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-01-29 09:41:46 +01:00
Cosmin Cojocar 3d5c97b418 Add a test sample for Cgo files 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-01-16 09:06:23 +01:00
Cosmin Cojocar 81e8278164 Add the Cgo files to the analysed files and ingonre all non-Go files 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-01-16 09:06:23 +01:00
Cosmin Cojocar a1969e208c Handle all errors in the formatter tests (#431) 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2020-01-16 09:05:38 +01:00
Cosmin Cojocar 99170e0d76 Update the README with some details about the CWE mapping (#407) 
* Fix some typos in the README file

Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>

* Update the README with some details about the CWE mapping

Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-10-31 11:56:17 +01:00
Cosmin Cojocar 28c1128b73 Add more tests to improve the coverage of resolve 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-10-08 11:56:58 +02:00
Cosmin Cojocar d78f02634a Format import to make codecov happy 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-10-08 11:56:58 +02:00
Cosmin Cojocar 50e1fe267d Improve the SSRF rule to report an issue for package scoped variables 
Made also the rule to not report an issue when encountering function
scoped variable which terminate in a basic literal such as a string.

Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-10-08 11:56:58 +02:00
Cosmin Cojocar 07770ae76d Add a test for composite literals when trying to resolve an AST tree node 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-10-08 11:56:58 +02:00
Cosmin Cojocar f413f1436d Handle the ValueSpec when trying to resolve an AST tree node 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-10-08 11:56:58 +02:00
Cosmin Cojocar c1970ff5c9 Handle the ValueSpec when trying to resolve an AST tree node 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-10-08 11:56:58 +02:00
Cosmin Cojocar ea9faae22d Update the Go version to 1.13 in the Dockerfile (#403) 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-10-08 09:44:34 +02:00
Cosmin Cojocar 186dec7b26 Convert the global settings to correct type when reading them from file (#399) 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-10-08 09:44:17 +02:00
Cosmin Cojocar e680875ea1 Replace the deprecated load mode with more specific flags are recommended in the packages docs (#400) 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-10-02 14:05:14 +02:00
Cosmin Cojocar 832d7bb398 Update README with CII Best Practicies badge 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2019-09-27 08:53:58 +10:00