Route redirect dependency checks through the cycle-safe
dependencyChecker instead of raw recursive valueDependsOn traversal.
This ensures Phi-cycle graphs terminate quickly and avoids recursive
work amplification that can look like hangs on large/generated
codebases.
Also remove the nil fallback in dependencyChecker.dependsOn so all
analyzer paths consistently use cycle-aware logic.
Add regression tests covering raw valueDependsOn behavior on:
Phi cycle without target (must return false)
Phi cycle with target path (must return true)
Self-referential Phi node (must return false)
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
Summary:
This change fixes the hang/perceived hang reported in issue #1555 when
scanning large codebases with complex SSA graphs. The fix is
intentionally scoped to G120 form parsing analysis only.
Root cause:
G120 wrapper/middleware protection logic repeatedly called
value-dependency checks across many function/call combinations. The
dependency traversal was depth-limited but not memoized, so cyclic and
branch-heavy SSA structures (especially Phi-related paths) caused
repeated re-traversal of the same graph regions and severe runtime
blowup.
What changed:
A cycle-safe, memoized dependency checker was added and used only inside
the G120 form parsing analysis flow. Existing G120 logic was kept
semantically equivalent while replacing repeated raw dependency
traversals with cached checks. Focused regression tests were added for
cyclic Phi graphs to verify both cases: no target reachable (false) and
target reachable (true), including stable repeated evaluation.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* fix(G705): eliminate false positive when guard type cannot be resolved
A guard cannot be satisfied when its type cannot be resolved.
Otherwise gosec fires for code like:
```go
package main
import (
"fmt"
"os"
)
func main() {
fmt.Fprint(os.Stdout, os.Args[1])
}
```
In this case the guard type `http.ResponseWriter` cannot be resolved, all guards (1)
are satisfied and we have a false gosec warning.
Signed-off-by: leonnicolas <leonloechner@gmx.de>
* remove the http package from example
---------
Signed-off-by: leonnicolas <leonloechner@gmx.de>
The relese process is extended to push also images to GHCR in addition
to DockerHub. This is in preparation to migrate to GHCR after the next
release.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* fix(G705): eliminate false positive for non-HTTP io.Writer
Adds ArgTypeGuards map[int]string to taint.Sink. The XSS analyzer now
requires arg[0] of fmt.Fprint* to implement net/http.ResponseWriter.
Writing exec pipe output to os.Stdout no longer triggers G705.
Fixes: #1548
* improve code coverage
This PR adds regression coverage for the G602 false-positive reported in
issue #1545 by introducing two sample cases: one valid range-over-array
indexing pattern that should not trigger, and one true out-of-bounds
variant that should still be detected.
It also fixes test instability in the rules suite by adding the missing
BurntSushi TOML module metadata required by G117 sample compilation in
the test harness.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* taint: skip `context.Context` args during taint propagation
`context.Context` is a control-flow mechanism (deadlines, cancellation,
request-scoped metadata) that does not carry user-controlled data
relevant to taint sinks. When `request.Context()` is passed to downstream
functions (gRPC clients, DB calls), the taint engine was conservatively
marking all return values as tainted, causing cascading false positives
for G703-G706 in any HTTP handler using the standard Go context pattern.
Add `isContextType()` helper and skip `context.Context-typed` arguments at
all four argument-scanning sites in the taint engine: interface method
calls, external static method calls, external plain function calls, and
`doTaintedArgsFlowToReturn` interprocedural analysis.
Receiver taint propagation (e.g., `req.URL.Query().Get()`) is unaffected.
ref: #1542
* taint: add tests for `isContextType` and context.Context false positive prevention
Add unit tests for the `isContextType` helper verifying it correctly
identifies context.Context and rejects non-context types (http.Request,
string, wrong package, pointer-wrapped, nil). Add G705 integration test
exercising the HTTP handler + r.Context() pattern that previously caused
false positives.
* fix(taint): handle pointer context types in isContextType
The isContextType function now properly unwraps pointer layers to
detect context.Context types even when wrapped in pointers
(e.g., *context.Context). This prevents false taint propagation
to function outputs from context arguments. Added comprehensive
test coverage for both direct context.Context and pointer
variants to ensure robust type checking.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This change introduces a new taint-analysis rule, G707, to detect
potential SMTP command/header injection when untrusted input reaches
net/smtp sink.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
Add a new SSA-based analyzer, G123, to detect risky TLS configurations
where VerifyPeerCertificate is set, VerifyConnection is not set, and
session resumption may still be enabled.
The analyzer inspects tls.Config field assignments and also follows
configurations returned from GetConfigForClient callbacks so
callback-based setup paths are covered as well.
This change wires G123 into analyzer registration, maps it to CWE-295,
updates the README rule list, and adds dedicated vulnerable/safe sample
coverage in analyzer tests.
It also includes a targeted #nosec G101 suppression on the analyzer
message string to prevent a known false positive from the linter
(message text only, no credential handling impact).
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
This change introduces a new SSA-based analyzer, G122, to detect unsafe
filesystem operations inside filepath.Walk, filepath.WalkDir, and
io/fs.WalkDir callbacks when callback path values flow into race-prone
sinks such as os.Remove, os.OpenFile, os.Rename, and os.Chmod.
It adds CWE mapping for the new rule as G122 -> CWE-367 (TOCTOU race
condition), and adds the CWE-367 definition to the CWE data.
It wires G122 into analyzer registration and updates the README
available rules list.
It adds dedicated G122 sample coverage with vulnerable and safe cases,
including safe root-scoped usage through os.Root APIs (for example
root.Open and root.Remove).
Validation was completed: full test suite passes, golangci-lint reports
zero issues, and gosec CLI validation confirms expected trigger and
non-trigger behavior for G122.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
This change fixes a false positive in G602 when iterating over
fixed-size arrays with range and indexing using the loop variable.
Corrects loop bound normalization in SSA-based index analysis so offsets
are not applied twice.
Preserves true-positive detection for real out-of-bounds patterns (for
example index + 1 at upper edge).
Adds regression samples covering both:
valid range-over-array indexing (no issue expected)
invalid shifted indexing inside the same loop (issue expected)
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Improve taint analyzer performance with shared SSA cache, parallel analyzer execution, and CI regression guard
* Added a shared per-package SSA analysis cache with lazy,
concurrency-safe call graph reuse across analyzers.
* Updated taint analyzers to consume the shared cache instead of
recomputing expensive artifacts per rule run.
* Parallelized analyzer execution at package level while preserving
deterministic issue aggregation.
* Added a package-level taint benchmark to measure real end-to-end taint
analyzer pass performance.
* Introduced a CI benchmark regression guard with configurable
thresholds for ns/op, B/op, and allocs/op.
* Documented the performance guard workflow, local run command, and
baseline update process in the README.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Fix script
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
---------
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
Introduces new G120 to detect potential memory-exhaustion paths caused
by unbounded form parsing in HTTP handlers.
Uses a pure SSA implementation (no AST fallback), checking ParseForm,
ParseMultipartForm, FormValue, and PostFormValue on *http.Request.
Suppresses findings when request bodies are explicitly bounded with
http.MaxBytesReader.
Wires G120 into analyzer registration, README rule catalog, and CWE
mapping (CWE-400).
Adds focused vulnerable/safe samples and analyzer test coverage;
analyzer tests and lint pass.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
Fixes false positives for guarded conversions in loops by excluding back-edge dominators from reachability check. Fixes false negatives for array/slice element conversions by preventing recursive range resolution through IndexAddr. Also fixes isNonNegative check for range loops.
* Add G118 SSA analyzer for context propagation failures that can cause goroutine/resource leaks
This PR introduces G118, a new SSA-based gosec rule that detects
high-risk context misuse patterns: goroutines using
context.Background/TODO when request context exists, missing cancel()
calls from WithCancel/WithTimeout/WithDeadline, and unbounded blocking
loop regions without ctx.Done() guards.
These patterns can leak goroutines and I/O resources, leading to
resource exhaustion/DoS in production services.
The rule is mapped to CWE-400, integrated into analyzer registration and
docs, and includes positive/negative samples (including complex loop CFG
cases) to reduce false positives while preserving detection quality.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Fix false pasitive
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
---------
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
Implements a new SSA-based analyzer G113 to detect HTTP request
smuggling vulnerabilities caused by setting conflicting
Transfer-Encoding and Content-Length headers on the same HTTP response.
Addresses CVE-2025-22871 where ambiguous HTTP message parsing can lead
to request smuggling attacks. When both Transfer-Encoding: chunked and
Content-Length headers are set, intermediary proxies and backend servers
may disagree on message boundaries, allowing attackers to inject
malicious requests.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Add G408: SSH PublicKeyCallback Authentication Bypass Analyzer
Implements a new SSA-based security analyzer (G408) that detects
stateful misuse of ssh.PublicKeyCallback in SSH server configurations.
This vulnerability can lead to authentication bypass where a server
authenticates one SSH key but performs authorization checks on a
different key.
This addresses a critical security vulnerability (CVE-2024-45337, CVSS
9.1) that has affected production systems including Kubernetes and other
SSH-based services. The vulnerability occurs when developers incorrectly
capture and modify state within PublicKeyCallback closures, enabling
attackers to authenticate with one key while the server operates on
another key's credentials.
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* Fix tests
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
---------
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
Cosmin Cojocar
Leon Löchner
Ravi Sastry Kadali
Richard RigbyandClaude Opus 4.6
Clara Bennett
renovate[bot]
Cameron Steffen
oittaa