mirror of
https://github.com/securego/gosec.git
synced 2026-06-20 00:15:59 +02:00
Cosmin Cojocar
f61ed314c2
Add a new SSA-based analyzer, G123, to detect risky TLS configurations where VerifyPeerCertificate is set, VerifyConnection is not set, and session resumption may still be enabled. The analyzer inspects tls.Config field assignments and also follows configurations returned from GetConfigForClient callbacks so callback-based setup paths are covered as well. This change wires G123 into analyzer registration, maps it to CWE-295, updates the README rule list, and adds dedicated vulnerable/safe sample coverage in analyzer tests. It also includes a targeted #nosec G101 suppression on the analyzer message string to prevent a known false positive from the linter (message text only, no credential handling impact). Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
78 lines
1.6 KiB
Go
78 lines
1.6 KiB
Go
package testutils
|
|
|
|
import "github.com/securego/gosec/v2"
|
|
|
|
// SampleCodeG123 - TLS resumption bypass of VerifyPeerCertificate when VerifyConnection is unset
|
|
var SampleCodeG123 = []CodeSample{
|
|
// Vulnerable: direct config uses VerifyPeerCertificate and leaves session tickets enabled
|
|
{[]string{`
|
|
package main
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
)
|
|
|
|
func main() {
|
|
_ = &tls.Config{
|
|
VerifyPeerCertificate: func(_ [][]byte, _ [][]*x509.Certificate) error { return nil },
|
|
}
|
|
}
|
|
`}, 1, gosec.NewConfig()},
|
|
|
|
// Vulnerable: GetConfigForClient returns stricter VerifyPeerCertificate config
|
|
{[]string{`
|
|
package main
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
)
|
|
|
|
func main() {
|
|
_ = &tls.Config{
|
|
GetConfigForClient: func(ch *tls.ClientHelloInfo) (*tls.Config, error) {
|
|
_ = ch
|
|
return &tls.Config{
|
|
VerifyPeerCertificate: func(_ [][]byte, _ [][]*x509.Certificate) error { return nil },
|
|
}, nil
|
|
},
|
|
}
|
|
}
|
|
`}, 2, gosec.NewConfig()},
|
|
|
|
// Safe: VerifyConnection is set (runs on resumed connections)
|
|
{[]string{`
|
|
package main
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
)
|
|
|
|
func main() {
|
|
_ = &tls.Config{
|
|
VerifyPeerCertificate: func(_ [][]byte, _ [][]*x509.Certificate) error { return nil },
|
|
VerifyConnection: func(_ tls.ConnectionState) error { return nil },
|
|
}
|
|
}
|
|
`}, 0, gosec.NewConfig()},
|
|
|
|
// Safe: session tickets explicitly disabled alongside VerifyPeerCertificate
|
|
{[]string{`
|
|
package main
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
)
|
|
|
|
func main() {
|
|
cfg := &tls.Config{}
|
|
cfg.VerifyPeerCertificate = func(_ [][]byte, _ [][]*x509.Certificate) error { return nil }
|
|
cfg.SessionTicketsDisabled = true
|
|
_ = cfg
|
|
}
|
|
`}, 0, gosec.NewConfig()},
|
|
}
|