Ravi Sastry Kadali 844b1703bf fix(G706): scope slog sinks to msg arg only to prevent false positives on structured attributes (#1623) ...

slog attribute values are auto-escaped by TextHandler/JSONHandler; only the message arg is a real injection vector.

Fixes: #1622

2026-03-25 21:46:59 +01:00

..

analyzers_set_test.go

Add more unit tests to improve coverage (#1512)

2026-02-14 21:57:51 +01:00

analyzers_set.go

Allow excluding analyzers globally (#1180)

2024-08-20 10:43:40 +02:00

analyzers_test.go

feat: add G124 rule for insecure HTTP cookie configuration (#1599)

2026-03-11 14:32:15 +01:00

analyzerslist_test.go

Port G120 from SSA-based to taint analysis (fixes #1600, #1603) (#1605)

2026-03-13 12:01:02 +01:00

analyzerslist.go

Port G120 from SSA-based to taint analysis (fixes #1600, #1603) (#1605)

2026-03-13 12:01:02 +01:00

anaylzers_suite_test.go

Allow excluding analyzers globally (#1180)

2024-08-20 10:43:40 +02:00

bench_test.go

Add support for go 1.26.x and removed support for go 1.24.x (#1508)

2026-02-14 13:53:19 +01:00

commandinjection.go

fix: broken taint analysis causing false positives (#1506)

2026-02-14 12:24:33 +01:00

context_propagation.go

fix(G118): eliminate false positive for package-level cancel variables (#1602)

2026-03-12 17:16:02 +01:00

conversion_overflow_test.go

Refactor Analyzers: Unify Range Logic & Optimize Allocations (#1464)

2026-01-14 10:52:35 +01:00

conversion_overflow.go

Fix G115 false positives for guarded int64-to-byte conversions (#1578)

2026-03-01 20:59:20 +01:00

cors_bypass_pattern.go

Add G121 analyzer for unsafe CORS bypass patterns in CrossOriginProtection (#1521)

2026-02-16 15:59:57 +01:00

dependency_checker_internal_test.go

Port G120 from SSA-based to taint analysis (fixes #1600, #1603) (#1605)

2026-03-13 12:01:02 +01:00

dependency_checker.go

Port G120 from SSA-based to taint analysis (fixes #1600, #1603) (#1605)

2026-03-13 12:01:02 +01:00

form_parsing_limits.go

Port G120 from SSA-based to taint analysis (fixes #1600, #1603) (#1605)

2026-03-13 12:01:02 +01:00

hardcoded_nonce.go

Fix incorrect detection of fixed iv in G407 (#1509)

2026-02-14 14:15:55 +01:00

insecure_cookie.go

feat: add G124 rule for insecure HTTP cookie configuration (#1599)

2026-03-11 14:32:15 +01:00

loginjection.go

fix(G706): scope slog sinks to msg arg only to prevent false positives on structured attributes (#1623)

2026-03-25 21:46:59 +01:00

pathtraversal.go

fix: taint analysis false positives with G703,G705 (#1522)

2026-02-19 15:43:03 +01:00

range_analyzer.go

Fix G115 false positives and negatives (Issue #1501) (#1518)

2026-02-16 13:58:21 +01:00

redirect_header_propagation.go

fix(analyzers): avoid SSA dependency cycle blowups in issue #1555 paths (#1559)

2026-02-28 10:47:40 +01:00

request_smuggling.go

Add G113: Detect HTTP Request Smuggling via conflicting headers (CVE-2025-22891, CWE-444) (#1515)

2026-02-15 18:48:01 +01:00

slice_bounds_test.go

Fix G602 analyzer panic that kills gosec process (#1491)

2026-02-07 11:30:59 +01:00

slice_bounds.go

fix(G602): avoid false positives for range-over-array indexing (#1531)

2026-02-19 17:39:14 +01:00

smtpinjection.go

Add G707 taint analyzer for SMTP command/header injection (#1535)

2026-02-21 11:12:34 +01:00

sqlinjection.go

fix: broken taint analysis causing false positives (#1506)

2026-02-14 12:24:33 +01:00

ssh_callback.go

Add G408: SSH PublicKeyCallback Authentication Bypass Analyzer (#1513)

2026-02-14 23:11:18 +01:00

ssrf.go

fix: broken taint analysis causing false positives (#1506)

2026-02-14 12:24:33 +01:00

ssti.go

feat: add G708 rule for server-side template injection via text/template (#1597)

2026-03-11 11:03:55 +01:00

tls_resumption_verifypeer.go

Add G123 analyzer for tls.VerifyPeerCertificate resumption bypass risk (#1534)

2026-02-21 10:42:36 +01:00

unsafe_deserialization.go

feat: add G709 rule for unsafe deserialization of untrusted data (#1598)

2026-03-11 12:31:10 +01:00

util_test.go

Add more unit tests to improve coverage (#1512)

2026-02-14 21:57:51 +01:00

util.go

Fix G115 false positives and negatives (Issue #1501) (#1518)

2026-02-16 13:58:21 +01:00

walk_symlink_race.go

Add G122 SSA analyzer for filepath.Walk/WalkDir symlink TOCTOU race risks (#1532)

2026-02-20 19:24:17 +01:00

xss.go

fix(G705): eliminate false positive for non-HTTP io.Writer (#1550)

2026-02-27 08:01:14 +01:00