1
0
mirror of https://github.com/securego/gosec.git synced 2025-06-14 23:45:03 +02:00
Commit Graph

28 Commits

Author SHA1 Message Date
c6e10af40f Handle properly the gosec module version v2
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
2020-04-06 09:06:23 -07:00
3e069e7756 Fix the errors rule whitelist to work on types methods
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
2020-01-29 09:41:46 +01:00
04dc713f22 One approach for fixing the false positive identified in #325. 2019-06-13 08:22:48 +10:00
41809946d4 Make G201 ignore CallExpr with no args (#262) 2018-11-05 09:28:47 +01:00
d3f1980e7a Fix false positives for SQL string concatenation with constants from another file (#247)
* Allow for SQL concatenation of nodes that resolve to literals

If node.Y resolves to a literal, it will not be considered as an issue.

* Fix typo in comment.

* Go through all files in package to resolve that identifier

* Refactor code and added comments.

* Changed checking to not var or func.

* Allow for supporting code for test cases.

* Resolve merge conflict changes.
2018-09-28 10:46:59 +03:00
762ff3a709 Allow quoted strings to be used to format SQL queries (#240)
* Support stripping vendor paths when matching calls

* Factor out matching of formatter string

* Quoted strings are safe to use with SQL str formatted strings

* Add test for allowing quoted strings with string formatters

* Install the pq package for tests to pass
2018-09-25 10:40:05 +03:00
b6891998ce Add Fprintf to Rule G201 2018-08-21 09:31:38 +02:00
a7cff91312 Small update to G201 and added ConcatString Function (#228) 2018-08-19 19:57:36 +02:00
893b87b343 Replace gas with gosec everywhere in the project 2018-07-19 18:42:25 +02:00
da26f64208 Rename github org (#214) 2018-07-19 17:40:28 +10:00
e809226800 Build improvments (#179)
* Add a semantic version to the usage text

* Add a comment to the version function

* Inject the version, git tag and build date as build variables

* Update README

* Fix lint warnings

* Update README

* Manage dependencies with dep tool instead of godep

* Add a Makefile for common build tasks

* Update the build file to use the make tool

* Update Dockerfile

* Add docker entry point in to make the passing of arguments easy

* Update README

* Add missing tools to the build

* Drop 1.7 support and add 1.10

* Fix Go 1.10 according with the travis guidelines

https://docs.travis-ci.com/user/languages/go/

* Update the tls-observatory package

* Fix lint warnings

* Change the output of the tests to be more verbose

* Check if the are build errors before executing the rule test
2018-03-13 08:57:10 +10:00
2115402409 Add the rule ID to issues (#188) 2018-03-12 18:18:44 +10:00
1429033aca Add support for #excluding specific rules 2018-03-02 23:44:51 +00:00
1ca335016a Rebase to master 2018-01-22 18:45:07 +00:00
8eb9cc02a4 Adjust SQL format-string rules to ignore inherently safe formats 2018-01-22 18:34:57 +00:00
af25ac1f6e fix golint errors picked up by hound-ci 2017-12-13 22:35:47 +10:00
6943f9e5e4 Major rework of codebase
- Get rid of 'core' and move CLI to cmd/gas directory
- Migrate (most) tests to use Ginkgo and testutils framework
- GAS now expects package to reside in $GOPATH
- GAS now can resolve dependencies for better type checking (if package
  on GOPATH)
- Simplified public API
2017-07-19 15:17:00 -06:00
bf78d027a9 Restructure and introduce a standalone config 2017-04-28 14:46:26 -07:00
cacf21f3c0 Restructure to focus on lib rather than cli 2017-04-26 08:08:46 -07:00
6ace60b950 Address unhandled error conditions
Closes #95
2016-12-02 10:20:23 -08:00
bf103da519 Allow rules to register against multiple ast nodes
Update the AddRule interface to allow rules to register interest in
multiple ast.Nodes. Adds more flexibility to how rules can work, and was
needed to fix the hard coded credentials test specifically.
2016-11-13 12:55:31 -08:00
d60a2b4ebb Confirmed correct behavior for SQL tests
Closes #64
2016-11-02 17:46:59 -07:00
686927c894 Address go vet failure in SQL rule 2016-11-02 17:12:23 -07:00
74b6633ee0 Updated imports to new repository location. 2016-11-02 16:54:20 -07:00
713949fe69 Rule selection rules
This makes the following changes:
- riles are identified by an ID
- include / exclude list now work
- rules are selected based on these lists
- blacklist rules are broken out into methods
- rule constructors now take the config map
- config file can be used to select rules
- CLI options embelish config selection options
2016-08-11 10:45:51 +01:00
cee5fad4c3 Fix incorrect regexp matches
There are some cases where the '.' character would also match any
character and could lead to incorrect results. For example the
regular expression -  `^ioutils.WriteFile$' would match
ioutils.WriteFile, but also ioutils_WriteFile.

Additionally made sure that all regexp were declared using raw
strings to avoid any unnecesary string escaping that potentially
make the regexp difficult to read.
2016-07-30 13:29:33 -07:00
3e4d96ef3e Better SQLi testing
This prevents the string concat tests flagging a false positive if
joining two literal strings (eg "SELECT * FROM " + " table" ... )
or with a constant (eg const tab = "name"; "SELECT * from " + tab)
2016-07-27 15:47:07 +01:00
4f3d620d37 Initial public release 2016-07-20 15:56:32 +01:00