Update README and DEVELOPMENT to list G707-G710 alongside the existing
taint rules. Add CWE-444 for G113 (HTTP request smuggling) and CWE-276
for G307 (os.Create permissions) so issues from those rules carry a CWE
weakness instead of nil. Fix a 'falg1' typo in flag_test that prevented
the validated-flag test from binding the flag it was meant to exercise.
Add taint analysis rule G709 to detect unsafe deserialization when
untrusted input flows into encoding/gob, encoding/xml, or
gopkg.in/yaml.v2 deserialization functions.
CWE-502. Includes 5 test samples (3 positive, 2 negative).
Add taint analysis rule G708 to detect SSTI vulnerabilities when using
Go text/template package. Covers two attack vectors:
- User input flowing into Template.Parse() (SSTI/RCE)
- Tainted data passed to Execute/ExecuteTemplate with http.ResponseWriter (XSS)
CWE-94. Includes 6 test samples (3 positive, 3 negative).
This change introduces a new taint-analysis rule, G707, to detect
potential SMTP command/header injection when untrusted input reaches
net/smtp sink.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
Add a new SSA-based analyzer, G123, to detect risky TLS configurations
where VerifyPeerCertificate is set, VerifyConnection is not set, and
session resumption may still be enabled.
The analyzer inspects tls.Config field assignments and also follows
configurations returned from GetConfigForClient callbacks so
callback-based setup paths are covered as well.
This change wires G123 into analyzer registration, maps it to CWE-295,
updates the README rule list, and adds dedicated vulnerable/safe sample
coverage in analyzer tests.
It also includes a targeted #nosec G101 suppression on the analyzer
message string to prevent a known false positive from the linter
(message text only, no credential handling impact).
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
This change introduces a new SSA-based analyzer, G122, to detect unsafe
filesystem operations inside filepath.Walk, filepath.WalkDir, and
io/fs.WalkDir callbacks when callback path values flow into race-prone
sinks such as os.Remove, os.OpenFile, os.Rename, and os.Chmod.
It adds CWE mapping for the new rule as G122 -> CWE-367 (TOCTOU race
condition), and adds the CWE-367 definition to the CWE data.
It wires G122 into analyzer registration and updates the README
available rules list.
It adds dedicated G122 sample coverage with vulnerable and safe cases,
including safe root-scoped usage through os.Root APIs (for example
root.Open and root.Remove).
Validation was completed: full test suite passes, golangci-lint reports
zero issues, and gosec CLI validation confirms expected trigger and
non-trigger behavior for G122.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
Introduces new G120 to detect potential memory-exhaustion paths caused
by unbounded form parsing in HTTP handlers.
Uses a pure SSA implementation (no AST fallback), checking ParseForm,
ParseMultipartForm, FormValue, and PostFormValue on *http.Request.
Suppresses findings when request bodies are explicitly bounded with
http.MaxBytesReader.
Wires G120 into analyzer registration, README rule catalog, and CWE
mapping (CWE-400).
Adds focused vulnerable/safe samples and analyzer test coverage;
analyzer tests and lint pass.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Add G118 SSA analyzer for context propagation failures that can cause goroutine/resource leaks
This PR introduces G118, a new SSA-based gosec rule that detects
high-risk context misuse patterns: goroutines using
context.Background/TODO when request context exists, missing cancel()
calls from WithCancel/WithTimeout/WithDeadline, and unbounded blocking
loop regions without ctx.Done() guards.
These patterns can leak goroutines and I/O resources, leading to
resource exhaustion/DoS in production services.
The rule is mapped to CWE-400, integrated into analyzer registration and
docs, and includes positive/negative samples (including complex loop CFG
cases) to reduce false positives while preserving detection quality.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Fix false pasitive
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
---------
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Add G408: SSH PublicKeyCallback Authentication Bypass Analyzer
Implements a new SSA-based security analyzer (G408) that detects
stateful misuse of ssh.PublicKeyCallback in SSH server configurations.
This vulnerability can lead to authentication bypass where a server
authenticates one SSH key but performs authorization checks on a
different key.
This addresses a critical security vulnerability (CVE-2024-45337, CVSS
9.1) that has affected production systems including Kubernetes and other
SSH-based services. The vulnerability occurs when developers incorrectly
capture and modify state within PublicKeyCallback closures, enabling
attackers to authenticate with one key while the server operates on
another key's credentials.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Fix tests
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
---------
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Refactor rules to utilize callListRule base structure
- Introduced a new base structure `callListRule` in `rules/base.go` to standardize the implementation of rules that check for specific function calls.
- Updated existing rules to inherit from `callListRule`, simplifying their structure and removing redundant ID methods.
- Modified the `MetaData` field to use `RuleID` instead of `ID` for consistency across rules.
- Removed the `weakcryptohash.go` and `weakdepricatedcryptohash.go` files as their functionality has been integrated into the new structure.
* fix(tlsconfig): correct MetaData field name in generated TLS check
* refactor: standardize rule metadata and call list initialization
The rule is supposed to detect for the usage of hardcoded or static nonce/Iv in many encryption algorithms:
* The different modes of AES (mainly tested here)
* It should be able to work with ascon
Currently the rules doesn't check when constant variables are used.
TODO: Improve the rule, to detected for constatant variable usage
This feature adds support to generate auto fixes for Go scanning findings using LLM (AI). In a first instance, it relies on Gemini API to get a suggestion for a solution. This can be later extended, to integrate also other AI providers.
---------
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
Co-authored-by: ccoVeille <3875889+ccoVeille@users.noreply.github.com>
Co-authored-by: Cosmin Cojocar <ccojocar@google.com>
* Rule G406 responsible for the usage of deprecated MD4 and RIPEMD160 added.
* Rules G506, G507 responsible for tracking the usage of the already mentioned libraries added.
* Slight changes in the Makefile(`make clean` wasn't removing all expected files)
* Added license to `analyzer_test.go`
Now the G401 rule is split into hashing and encryption algorithms.
G401 is responsible for checking the usage of MD5 and SHA1, with corresponding CWE of 328.
And G405(New rule) is responsible for checking the usege of DES and RC4, with corresponding CWE of 327.
Track ignored issues using file location instead of a AST node. There are issues linked to a different AST node than the original node used to start the scan.
Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
* Added slice bounds testing for slice expressions.
* Added checking slice index.
* Added test for reassigning slice.
* Store capacities on reslicing.
* Scope change clears map. Func name used to track slices.
* Map CallExpr to check bounds when passing to functions.
* Fixed linter errors.
* Updated rulelist with CWE mapping.
* Added comment for NewSliceBoundCheck.
* Addressed nil cap runtime error.
* Replaced usage of nil in call arg map with dummy callexprs.
* Updated comments, wrapped error return, addressed other review concerns.
* Remove read only types from unsafe defer rules
* Remove rule G307 which checks when an error is not handled when a file or socket connection is closed
This doesn't seem to bring much value from security perspective, and it caused a lot of controversy since
is a very common pattern in Go.
* Mentioned in documentation that rule G307 is retired
* Clean up the test for rule G307
Ravi Sastry Kadali
Cosmin Cojocar
oittaa
kfessandCosmin Cojocar
Brandon AnninandccoVeille
Dimitar Banchev
Cosmin Cojocar
Oleksandr Redko
Morgen Malinoski
Matthieu MOREL