go/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2025-07-17 01:12:33 +02:00
Code Issues Releases Activity
713 Commits 9 Branches 47 Tags
b45f95f6adc41d11147094107b47019cdc26638c
Commit Graph

713 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Yiwei Ding
b45f95f6ad Add support for suppressing the findings v2.9.4 2021-12-09 11:53:36 +01:00
renovate[bot]
040327f7d7 chore(deps): update all dependencies (#734) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-12-07 15:49:48 +01:00
Lars
6a41fb9e61 Fix https://github.com/securego/gosec/issues/714 (#733) v2.9.3 2021-11-24 16:34:42 +01:00
renovate[bot]
c95e9c21e7 chore(deps): update all dependencies (#731) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-11-22 14:04:48 +01:00
Cosmin Cojocar
e57efa8482 Fix a panic in suproc rule when the declaration of the variable is not available in the AST (#728) v2.9.2 2021-11-16 21:41:26 +01:00
Marc Brugger
ff17c30a97 Use go embed for templates (#725) 2021-11-15 16:17:22 +01:00
Matthew Jaffee
3eba7b8a3e add openssh to docker image (#719) 
I'm trying to scan a project which has dependencies which are private projects. When Go tries to fetch the dependencies it normally uses HTTPS, but that doesn't work if they're private (terminal prompts disabled, can't enter username/password). So you do this little trick with git configuration to get Go to fetch dependencies over ssh: `GIT_CONFIG_PARAMETERS=url.ssh://git@github.com/.insteadOf=https://github.com/`
unfortunately the docker image doesn't have ssh installed so this doesn't work :)
 2021-11-10 21:13:20 +01:00
Cosmin Cojocar
55c6ceaaa6 Fix crash when parsing the TLS min version value (#724) 2021-11-09 21:59:53 +01:00
Ville Skyttä
40fa36d1de G303: catch with os.WriteFile, add os.Create test case (#718) 
* Add G303 os.Create test case

* Catch G303 with os.WriteFile too
 2021-11-09 21:13:45 +01:00
renovate[bot]
873ac243ea chore(deps): update all dependencies (#722) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-11-09 21:05:07 +01:00
Ville Skyttä
f1f0056a90 Spelling fixes (#717) 2021-11-09 21:02:24 +01:00
renovate[bot]
0680c75f99 chore(deps): update all dependencies (#716) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-11-01 20:56:57 +01:00
Ryan Leung
79c8b79263 use a better naming for the variable (#715) 
Signed-off-by: Ryan Leung <rleungx@gmail.com>
 2021-10-19 11:54:51 +02:00
Cosmin Cojocar
69213955da Fix the SBOM generation step in the release action (#712) v2.9.1 2021-10-15 10:57:09 +02:00
Cosmin Cojocar
5a3a27afae Phase out support for go version 1.15 because current ginko is not backward compatible (#710) 
We are going to support only the stable versions provided by the Go team.
 2021-10-15 10:46:13 +02:00
Cam
17105ab93e spelling fix (#708) v2.9.0 2021-10-14 09:54:32 +02:00
xq840622
1297bedbc7 Update README.md (#707) 
"io/ioutil" package name is "ioutil"
 2021-10-14 09:54:09 +02:00
Eng Zer Jun
7fd4aef9dc feat: add os.ReadFile to G304 (#706) 
In Go 1.16 or higher, the `io/ioutil` has been deprecated and the
`ioutil.ReadFile` function now calls `os.ReadFile`.

Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
 2021-10-14 09:53:26 +02:00
nobishii
991dd94f3a Update local installation instruction (#703) 
Update local installation instruction for Go1.16+.
 2021-10-05 19:33:55 +02:00
Yuval Kashtan
1933cba5b5 Add os.Unsetenv to NoErrorCheck whitelist (#702) 
it always return nil err
 2021-10-05 19:30:34 +02:00
renovate[bot]
e73248cc12 chore(deps): update all dependencies (#701) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-10-05 19:29:19 +02:00
Matthieu MOREL
c59cd6bb95 Update renovate.json (#699) 2021-09-19 23:24:39 +02:00
Matthieu MOREL
bfb0f422fe chore(lint): enable errorlint and gci (#698) 2021-09-13 09:40:10 +02:00
renovate[bot]
cb89567f99 chore(deps): update module github.com/lib/pq to v1.10.3 (#695) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-09-13 09:39:36 +02:00
Cosmin Cojocar
1b2eecc8c4 Enable go 1.17 in the build and release workflows (#694) 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2021-09-02 14:59:49 +02:00
Nanik
efbefc6930 fix: create a separate type for flag that has validation (#692) 2021-09-02 14:44:20 +02:00
renovate[bot]
1978a52ff4 Update all dependencies (#690) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-08-23 08:04:46 +02:00
Marc Brugger
fd5472caaf remove tabs (#689) 2021-08-20 10:27:45 +02:00
Cosmin Cojocar
d3309fb4f5 Add a more generic message for rule g204 (#688) 2021-08-19 15:18:20 +02:00
Marc Brugger
b695b66e4d add key to Highlight component (#686) 2021-08-19 14:54:12 +02:00
Marc Brugger
aee782bfe8 add summary to html report (#687) 2021-08-19 14:53:39 +02:00
Cosmin Cojocar
f285d612b5 Fix formatting issues with gofumpt (#685) 
Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
 2021-08-18 13:16:21 +02:00
Marc Brugger
ba23b5e49a Add possibility to list waived (nosec) marked issues but not count them as such 2021-08-18 13:00:38 +02:00
Nanik
5a131be2ec fix: add more rules for G204 (#677) 
* fix: add more rules for G204

* fix: add extra test and comment
 2021-08-16 11:31:51 +02:00
Rodrigo Broggi
9f30bb6602 Typo correction (#681) 
Correcting the command flag from 'tag' to 'tags'
 2021-08-16 11:29:35 +02:00
renovate[bot]
83355dc837 Update all dependencies (#683) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-08-16 11:28:27 +02:00
renovate[bot]
2d4133d7a1 Update module github.com/onsi/gomega to v1.15.0 (#679) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-08-09 17:29:21 +02:00
Phil Calçado
91447a45f5 Add SeatGeek to USERS.md (#678) 
We just added gosec to our standard Golang tooling and pipelines.
 2021-08-09 17:28:31 +02:00
Marc Brugger
c0c122cdc7 Add rule ID and CWE reference to the html report 2021-08-04 17:39:03 +02:00
Marc Brugger
62db81342e Allow excluding generated files 2021-08-04 17:33:20 +02:00
Marc Brugger
521e69ef66 Allows the exclude-dir option to exclude sub directories 2021-08-04 17:31:16 +02:00
Lars
d4dc2d2df5 Improve the G307 rule 
* Add G307 sample code.
The sample should reflect a defered close that leads to data loss.
Due to IDE auto-complete people tend at least log errors, but not
really care about handling.

* Add more G307 sample code. Propose a way to implement

* Remove unused code. Add example that should not return an error but does

* Remove test for synced closed file for now.
Will add this later

Co-authored-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2021-07-31 23:03:09 +02:00
Nanik
8b90c95c07 fix: BUILDFLAGS updated with correct versions information (#672) 2021-07-30 16:58:13 +02:00
renovate[bot]
5b3d23117c Update codecov/codecov-action action to v2 (#670) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-07-27 22:04:29 +02:00
Nanik
9535c9e3e1 fix: add variable assignment checking as part of MinVersion (#669) 
* fix: add variable assignment checking as part of MinVersion

* fix: add more code to allow assignment with const

* fix: rework the code and add more test cases for MinVersion

* fix: format linting issue using gofumpt
 2021-07-27 22:03:59 +02:00
renovate[bot]
b869720342 Update module golang.org/x/tools to v0.1.5 (#668) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-07-19 11:26:21 +02:00
Niklas
0ee8ad3d5b Use version ^v0 instead of latest for cyclonedx-gomod (#667) 
To avoid breaking the build when cyclonedx-gomod introduces breaking changes in a new major version. See https://github.com/CycloneDX/gh-gomod-generate-sbom/releases/tag/v0.3.0

Signed-off-by: nscuro <nscuro@protonmail.com>
 2021-07-19 11:25:04 +02:00
Nanik
2a4064d45d feat: adding new keyword for hardcoded credentials (#666) 2021-07-19 11:23:39 +02:00
renovate[bot]
a484c77736 Update all dependencies (#663) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-07-13 18:43:09 +02:00
Josh Kaufman
514f65f3c3 Add G204 rule for sys/execabs (#660) 
* Add G204 rule for sys/execabs

* syntax error in testutils/sources.go
 2021-07-01 17:43:25 +02:00