Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: securego/gosec
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v2.19.0
Choose a base ref
...
head repository: securego/gosec
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v2.20.0
Choose a head ref
9 contributors

Commits on Feb 12, 2024

  1. Update gosec version to v2.19.0 in the Github action 

    Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
    @ccojocar
    ccojocar committed Feb 12, 2024

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    d13d7da View commit details

Commits on Feb 13, 2024

  1. fix(hardcoded): remove duplicated Stripe API Key

    @quentin-laplanche @ccojocar
    quentin-laplanche authored and ccojocar committed Feb 13, 2024
    Copy the full SHA
    c824a5d View commit details

Commits on Feb 19, 2024

  1. chore(deps): update module golang.org/x/tools to v0.18.0

    @renovate @ccojocar
    renovate[bot] authored and ccojocar committed Feb 19, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    198a40c View commit details

Commits on Mar 4, 2024

  1. chore(deps): update all dependencies

    @renovate @ccojocar
    renovate[bot] authored and ccojocar committed Mar 4, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    582e91a View commit details

  2. Ignore 'implicit memory aliasing' rule for Go 1.22+ 

    Signed-off-by: Janusz Marcinkiewicz <januszm@nvidia.com>
    @VirrageS @ccojocar
    VirrageS authored and ccojocar committed Mar 4, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    f25ccd9 View commit details

Commits on Mar 7, 2024

  1. Update go version to 1.22.1 and 1.21.8 

    Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
    @ccojocar
    ccojocar committed Mar 7, 2024
    Copy the full SHA
    903c75b View commit details

  2. Skip the G601 tests for Go version 1.22 

    Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
    @ccojocar
    ccojocar committed Mar 7, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    36878a9 View commit details

  3. Add support for math/rand/v2 added in Go 1.22

    @hyorimitsu @ccojocar
    hyorimitsu authored and ccojocar committed Mar 7, 2024
    Copy the full SHA
    be378e6 View commit details

  4. Fix lint warnings

    @hyorimitsu @ccojocar
    hyorimitsu authored and ccojocar committed Mar 7, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    11c3252 View commit details

Commits on Mar 8, 2024

  1. Refactor: use standard function to check if a file is generated 

    As of Go1.21, we can use https://pkg.go.dev/go/ast#IsGenerated to check if a file is generated.
Probably we want to use this instead of own implementation.
    @nobishino @ccojocar
    nobishino authored and ccojocar committed Mar 8, 2024
    Copy the full SHA
    3a0ea51 View commit details

  2. Fix test: update test to comply with the spec of generated sources 

    https://pkg.go.dev/cmd/go#hdr-Generate_Go_files_by_processing_source says:

> This line must appear before the first non-comment, non-blank text in the file.

Original test cases fail with the previous commit because test source does not comply with this spec.
So, probably we should update test case to comply with the spec.
(This is a breaking change, though)
    @nobishino @ccojocar
    nobishino authored and ccojocar committed Mar 8, 2024
    Copy the full SHA
    ccb0a08 View commit details

  3. Fixup: delete unused variable

    @nobishino @ccojocar
    nobishino authored and ccojocar committed Mar 8, 2024
    Copy the full SHA
    b6df69c View commit details

  4. Format the imports using the gci tool 

    Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
    @ccojocar
    ccojocar committed Mar 8, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    48aa72e View commit details

Commits on Mar 11, 2024

  1. chore(deps): update all dependencies

    @renovate @ccojocar
    renovate[bot] authored and ccojocar committed Mar 11, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    accd7a1 View commit details

  2. chore: fix function name 

    Signed-off-by: avoidalone <wuguangdong@outlook.com>
    @avoidalone @ccojocar
    avoidalone authored and ccojocar committed Mar 11, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    43b8b75 View commit details

Commits on Mar 20, 2024

  1. fix(helpers/goversion): get from go.mod

    @gnuletik @ccojocar
    gnuletik authored and ccojocar committed Mar 20, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    5513615 View commit details

Commits on Mar 25, 2024

  1. chore(deps): update all dependencies

    @renovate @ccojocar
    renovate[bot] authored and ccojocar committed Mar 25, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    e27f442 View commit details

Commits on Apr 2, 2024

  1. chore(deps): update module github.com/onsi/ginkgo/v2 to v2.17.1

    @renovate @ccojocar
    renovate[bot] authored and ccojocar committed Apr 2, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    daf6f67 View commit details

Commits on Apr 8, 2024

  1. chore(deps): update all dependencies

    @renovate @ccojocar
    renovate[bot] authored and ccojocar committed Apr 8, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    31009c3 View commit details

  2. Update to go 1.22.2 

    Signed-off-by: Cosmin Cojocar <gcojocar@adobe.com>
    @ccojocar
    ccojocar committed Apr 8, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    3b23ec8 View commit details

Commits on Apr 22, 2024

  1. chore(deps): update module github.com/onsi/gomega to v1.33.0

    @renovate @ccojocar
    renovate[bot] authored and ccojocar committed Apr 22, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    09d62bd View commit details

Commits on May 2, 2024

  1. chore(deps): update all dependencies

    @renovate @ccojocar
    renovate[bot] authored and ccojocar committed May 2, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    cf29d54 View commit details

Commits on May 6, 2024

  1. chore(deps): update module golang.org/x/text to v0.15.0

    @renovate @ccojocar
    renovate[bot] authored and ccojocar committed May 6, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    d3b2359 View commit details

Commits on May 12, 2024

  1. Update Go to version 2.22.3 in CI and release 

    Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
    @ccojocar
    ccojocar committed May 12, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    8658b8e View commit details

Commits on May 13, 2024

  1. chore(deps): update all dependencies

    @renovate @ccojocar
    renovate[bot] authored and ccojocar committed May 13, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    d34f8b7 View commit details

  2. Add filepath.EvalSymlinks to clean functions in rule G304 

    Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
    @ccojocar
    ccojocar committed May 13, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    417a44c View commit details

Commits on May 14, 2024

  1. Add a unit test to detect the false negative in rule G306 for os.Mode… 

    …Perm permissions

Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
    @ccojocar
    ccojocar committed May 14, 2024
    Copy the full SHA
    dc5e5a9 View commit details

  2. Catch os.ModePerm permissions in os.WriteFile 

    Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
    @ccojocar
    ccojocar committed May 14, 2024
    Loading
    Loading status checks…
    Copy the full SHA
    6fbd381 View commit details
Showing with 242 additions and 92 deletions.
  1. +3 −3 .github/workflows/ci.yml
  2. +2 −2 .github/workflows/release.yml
  3. +1 −1 README.md
  4. +1 −1 action.yml
  5. +5 −17 analyzer.go
  6. +2 −2 analyzer_test.go
  7. +12 −12 go.mod
  8. +26 −27 go.sum
  9. +37 −8 helpers.go
  10. +8 −0 import_tracker.go
  11. +2 −2 report/html/template.html
  12. +13 −1 rules/fileperms.go
  13. +0 −4 rules/hardcoded_credentials.go
  14. +6 −0 rules/implicit_aliasing.go
  15. +14 −10 rules/rand.go
  16. +1 −0 rules/readfile.go
  17. +4 −1 rules/rules_test.go
  18. +20 −1 testutils/g306_samples.go
  19. +85 −0 testutils/g404_samples.go
6 changes: 3 additions & 3 deletions .github/workflows/ci.yml
View file
Original file line number Diff line number Diff line change
@@ -10,7 +10,7 @@ jobs:
test:
strategy:
matrix:
version: [{go: '1.21.7', golangci: 'latest'}, {go: '1.22.0', golangci: 'latest'}]
version: [{go: '1.21.10', golangci: 'latest'}, {go: '1.22.3', golangci: 'latest'}]
runs-on: ubuntu-latest
env:
GO111MODULE: on
@@ -28,7 +28,7 @@ jobs:
restore-keys: |
${{ runner.os }}-go-
- name: lint
uses: golangci/golangci-lint-action@v4
uses: golangci/golangci-lint-action@v6
with:
version: ${{ matrix.version.golangci }}
- name: Run Gosec Security Scanner
@@ -46,7 +46,7 @@ jobs:
- name: Setup go
uses: actions/setup-go@v5
with:
go-version: '1.22.0'
go-version: '1.22.3'
- name: Checkout Source
uses: actions/checkout@v4
- uses: actions/cache@v4
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Original file line number Diff line number Diff line change
@@ -17,11 +17,11 @@ jobs:
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version: '1.22.0'
go-version: '1.22.3'
- name: Install Cosign
uses: sigstore/cosign-installer@v3
with:
cosign-release: 'v2.2.3'
cosign-release: 'v2.2.4'
- name: Store Cosign private key in a file
run: 'echo "$COSIGN_KEY" > /tmp/cosign.key'
shell: bash
2 changes: 1 addition & 1 deletion README.md
View file
Original file line number Diff line number Diff line change
@@ -159,7 +159,7 @@ directory you can supply `./...` as the input argument.
- G503: Import blocklist: crypto/rc4
- G504: Import blocklist: net/http/cgi
- G505: Import blocklist: crypto/sha1
- G601: Implicit memory aliasing of items from a range statement
- G601: Implicit memory aliasing of items from a range statement (only for Go 1.21 or lower)
- G602: Slice access out of bounds

### Retired rules
2 changes: 1 addition & 1 deletion action.yml
View file
Original file line number Diff line number Diff line change
@@ -10,7 +10,7 @@ inputs:

runs:
using: 'docker'
image: 'docker://securego/gosec:2.18.2'
image: 'docker://securego/gosec:2.19.0'
args:
- ${{ inputs.args }}

22 changes: 5 additions & 17 deletions analyzer.go
View file
Original file line number Diff line number Diff line change
@@ -31,11 +31,12 @@ import (
"strings"
"sync"

"github.com/securego/gosec/v2/analyzers"
"github.com/securego/gosec/v2/issue"
"golang.org/x/tools/go/analysis"
"golang.org/x/tools/go/analysis/passes/buildssa"
"golang.org/x/tools/go/packages"

"github.com/securego/gosec/v2/analyzers"
"github.com/securego/gosec/v2/issue"
)

// LoadMode controls the amount of details to return when loading the packages
@@ -55,8 +56,6 @@ const externalSuppressionJustification = "Globally suppressed."

const aliasOfAllRules = "*"

var generatedCodePattern = regexp.MustCompile(`^// Code generated .* DO NOT EDIT\.$`)

type ignore struct {
start int
end int
@@ -376,7 +375,7 @@ func (gosec *Analyzer) CheckRules(pkg *packages.Package) {
if filepath.Ext(checkedFile) != ".go" {
continue
}
if gosec.excludeGenerated && isGeneratedFile(file) {
if gosec.excludeGenerated && ast.IsGenerated(file) {
gosec.logger.Println("Ignoring generated file:", checkedFile)
continue
}
@@ -459,7 +458,7 @@ func (gosec *Analyzer) CheckAnalyzers(pkg *packages.Package) {
func (gosec *Analyzer) generatedFiles(pkg *packages.Package) map[string]bool {
generatedFiles := map[string]bool{}
for _, file := range pkg.Syntax {
if isGeneratedFile(file) {
if ast.IsGenerated(file) {
fp := pkg.Fset.File(file.Pos())
if fp == nil {
// skip files which cannot be located
@@ -500,17 +499,6 @@ func (gosec *Analyzer) buildSSA(pkg *packages.Package) (interface{}, error) {
return ssaPass.Analyzer.Run(ssaPass)
}

func isGeneratedFile(file *ast.File) bool {
for _, comment := range file.Comments {
for _, row := range comment.List {
if generatedCodePattern.MatchString(row.Text) {
return true
}
}
}
return false
}

// ParseErrors parses the errors from given package
func (gosec *Analyzer) ParseErrors(pkg *packages.Package) error {
if len(pkg.Errors) == 0 {
4 changes: 2 additions & 2 deletions analyzer_test.go
View file
Original file line number Diff line number Diff line change
@@ -498,8 +498,8 @@ var _ = Describe("Analyzer", func() {
pkg := testutils.NewTestPackage()
defer pkg.Close()
pkg.AddFile("foo.go", `
package foo
// Code generated some-generator DO NOT EDIT.
package foo
func test() error {
return nil
}
@@ -541,8 +541,8 @@ var _ = Describe("Analyzer", func() {
pkg := testutils.NewTestPackage()
defer pkg.Close()
pkg.AddFile("foo.go", `
package main
// Code generated some-generator DO NOT EDIT.
package main
import (
"fmt"
)
24 changes: 12 additions & 12 deletions go.mod
View file
Original file line number Diff line number Diff line change
@@ -6,25 +6,25 @@ require (
github.com/gookit/color v1.5.4
github.com/lib/pq v1.10.9
github.com/mozilla/tls-observatory v0.0.0-20210609171429-7bc42856d2e5
github.com/onsi/gomega v1.31.1
golang.org/x/crypto v0.19.0
github.com/onsi/ginkgo/v2 v2.17.2
github.com/onsi/gomega v1.33.1
golang.org/x/crypto v0.23.0
golang.org/x/lint v0.0.0-20210508222113-6edffad5e616
golang.org/x/text v0.14.0
golang.org/x/tools v0.17.0
golang.org/x/text v0.15.0
golang.org/x/tools v0.21.0
gopkg.in/yaml.v3 v3.0.1
)

require github.com/onsi/ginkgo/v2 v2.15.0

require (
github.com/go-logr/logr v1.3.0 // indirect
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/google/go-cmp v0.6.0 // indirect
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect
github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 // indirect
github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
golang.org/x/mod v0.14.0 // indirect
golang.org/x/net v0.20.0 // indirect
golang.org/x/sys v0.17.0 // indirect
golang.org/x/mod v0.17.0 // indirect
golang.org/x/net v0.25.0 // indirect
golang.org/x/sync v0.7.0 // indirect
golang.org/x/sys v0.20.0 // indirect
)

go 1.20
53 changes: 26 additions & 27 deletions go.sum
View file
Original file line number Diff line number Diff line change
@@ -100,13 +100,13 @@ github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2
github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-redis/redis v6.15.8+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
@@ -137,7 +137,6 @@ github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:W
github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
@@ -159,8 +158,8 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
github.com/google/pprof v0.0.0-20200507031123-427632fa3b1c/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 h1:yAJXTCF9TqKcTiHJAE8dj7HMvPfh66eeA2JYW7eFpSE=
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 h1:k7nVchz72niMH6YLQNvHSdIE7iqsQxK1P41mySCvssg=
github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
github.com/google/trillian v1.3.11/go.mod h1:0tPraVHrSDkA3BO6vKX67zgLXs6SsOAbHEivX+9mPgw=
github.com/google/uuid v0.0.0-20161128191214-064e2069ce9c/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -191,7 +190,6 @@ github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpO
github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
github.com/imdario/mergo v0.3.4/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
@@ -263,11 +261,11 @@ github.com/olekukonko/tablewriter v0.0.1/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXW
github.com/olekukonko/tablewriter v0.0.2/go.mod h1:rSAaSIOAGT9odnlyGlUfAJaoc5w2fSBUmeGDbRWPxyQ=
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo/v2 v2.15.0 h1:79HwNRBAZHOEwrczrgSOPy+eFTTlIGELKy5as+ClttY=
github.com/onsi/ginkgo/v2 v2.15.0/go.mod h1:HlxMHtYF57y6Dpf+mc5529KKmSq9h2FpCF+/ZkwUxKM=
github.com/onsi/ginkgo/v2 v2.17.2 h1:7eMhcy3GimbsA3hEnVKdw/PQM9XN9krpKVXsZdph0/g=
github.com/onsi/ginkgo/v2 v2.17.2/go.mod h1:nP2DPOQoNsQmsVyv5rDA8JkXQoCs6goXIvr/PRJ1eCc=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.31.1 h1:KYppCUK+bUgAZwHOu7EXVBKyQA6ILvOESHkn/tgoqvo=
github.com/onsi/gomega v1.31.1/go.mod h1:y40C95dwAD1Nz36SsEnxvfFe8FFfNxzI5eJ0EYGyAy0=
github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
@@ -365,8 +363,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -400,8 +398,8 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB
golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -434,8 +432,8 @@ golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/
golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -450,7 +448,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -491,17 +490,17 @@ golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7w
golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -553,8 +552,8 @@ golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roY
golang.org/x/tools v0.0.0-20200626171337-aa94e735be7f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200630154851-b2d8b0336632/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20200706234117-b22de6825cf7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
golang.org/x/tools v0.21.0 h1:qc0xYgIbsSDt9EyWz05J5wfa7LOVW0YTLOXrqdLAWIw=
golang.org/x/tools v0.21.0/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -636,7 +635,7 @@ google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
45 changes: 37 additions & 8 deletions helpers.go
View file
Original file line number Diff line number Diff line change
@@ -15,12 +15,15 @@
package gosec

import (
"bytes"
"encoding/json"
"errors"
"fmt"
"go/ast"
"go/token"
"go/types"
"os"
"os/exec"
"os/user"
"path/filepath"
"regexp"
@@ -260,7 +263,7 @@ func getIdentStringValues(ident *ast.Ident, stringFinder func(ast.Node) (string,
return values
}

// getIdentStringRecursive returns the string of values of an Ident if they can be resolved
// GetIdentStringValuesRecursive returns the string of values of an Ident if they can be resolved
// The difference between this and GetIdentStringValues is that it will attempt to resolve the strings recursively,
// if it is passed a *ast.BinaryExpr. See GetStringRecursive for details
func GetIdentStringValuesRecursive(ident *ast.Ident) []string {
@@ -493,19 +496,45 @@ func RootPath(root string) (string, error) {
return filepath.Abs(root)
}

// GoVersion returns parsed version of Go from runtime
// GoVersion returns parsed version of Go mod version and fallback to runtime version if not found.
func GoVersion() (int, int, int) {
return parseGoVersion(runtime.Version())
goVersion, err := goModVersion()
if err != nil {
return parseGoVersion(strings.TrimPrefix(runtime.Version(), "go"))
}

return parseGoVersion(goVersion)
}

type goListOutput struct {
GoVersion string `json:"GoVersion"`
}

func goModVersion() (string, error) {
cmd := exec.Command("go", "list", "-m", "-json")

raw, err := cmd.CombinedOutput()
if err != nil {
return "", fmt.Errorf("command go list: %w: %s", err, string(raw))
}

var v goListOutput
err = json.NewDecoder(bytes.NewBuffer(raw)).Decode(&v)
if err != nil {
return "", fmt.Errorf("unmarshaling error: %w: %s", err, string(raw))
}

return v.GoVersion, nil
}

// parseGoVersion parses Go version.
// example:
// - go1.19rc2
// - go1.19beta2
// - go1.19.4
// - go1.19
// - 1.19rc2
// - 1.19beta2
// - 1.19.4
// - 1.19
func parseGoVersion(version string) (int, int, int) {
exp := regexp.MustCompile(`go(\d+).(\d+)(?:.(\d+))?.*`)
exp := regexp.MustCompile(`(\d+).(\d+)(?:.(\d+))?.*`)
parts := exp.FindStringSubmatch(version)
if len(parts) <= 1 {
return 0, 0, 0
8 changes: 8 additions & 0 deletions import_tracker.go
View file
Original file line number Diff line number Diff line change
@@ -15,9 +15,12 @@ package gosec
import (
"go/ast"
"go/types"
"regexp"
"strings"
)

var versioningPackagePattern = regexp.MustCompile(`v[0-9]+$`)

// ImportTracker is used to normalize the packages that have been imported
// by a source file. It is able to differentiate between plain imports, aliased
// imports and init only imports.
@@ -66,5 +69,10 @@ func importName(importPath string) string {
if len(parts) > 0 {
name = parts[len(parts)-1]
}
// If the last segment of the path is version information, consider the second to last segment as the package name.
// (e.g., `math/rand/v2` would be `rand`)
if len(parts) > 1 && versioningPackagePattern.MatchString(name) {
name = parts[len(parts)-2]
}
return name
}
4 changes: 2 additions & 2 deletions report/html/template.html
View file
Original file line number Diff line number Diff line change
@@ -4,13 +4,13 @@
<meta charset="utf-8">
<title>Golang Security Checker</title>
<link rel="shortcut icon" type="image/png" href="https://securego.io/img/favicon.png">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bulma/0.9.4/css/bulma.min.css" integrity="sha512-HqxHUkJM0SYcbvxUw5P60SzdOTy/QVwA1JJrvaXJv4q7lmbDZCmZaqz01UPOaQveoxfYRv1tHozWGPMcuTBuvQ==" crossorigin="anonymous"/>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bulma/1.0.0/css/bulma.min.css" integrity="sha512-+oEiKVGJRHutsibRYkkTIfjI0kspDtgJtkIlyPCNTCFCdhy+nSe25nvrCw7UpHPwNbdmNw9AkgGA+ptQxcjPug==" crossorigin="anonymous"/>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/default.min.css" integrity="sha512-hasIneQUHlh06VNBe7f6ZcHmeRTLIaQWFd43YriJ0UND19bvYRauxthDg8E4eVNPm9bRUhr5JGeqH7FRFXQu5g==" crossorigin="anonymous"/>
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js" integrity="sha512-D9gUyxqja7hBtkWpPWGt9wfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ==" crossorigin="anonymous"></script>
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/languages/go.min.js" integrity="sha512-wsnZc3vH14xwbbaoAwkar86729DTpz6wx48ABISfmaKLZwP/lm8d7Z+Hmr9JKobAENs0qO/cGounL7LUEg10Pg==" crossorigin="anonymous"></script>
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/react/15.7.0/react.min.js" integrity="sha512-+TFn1Gqbwx/qgwW3NU1/YtFYTfHGeD1e/8YfJZzkb6TFEZP4SUwp1Az9DMeWh3qC0F+YPKXbV3YclMUwBTvO3g==" crossorigin="anonymous"></script>
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/react/15.6.1/react-dom.min.js" integrity="sha512-8C49ZG/SaQnWaUgCHTU1o8uIQNYE6R8me38SwF26g2Q0byEXF4Jlvm+T/JAMHMeTBiEVPslSZRv9Xt4AV0pfmw==" crossorigin="anonymous"></script>
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/babel-standalone/7.23.10/babel.min.js" integrity="sha512-aKni+N2bgewoe8CGZlB9c0IDLU5LQaMEZFNjP6FbDK8gZhdTdNKhYKgZaY/EYL9GKJeJigN/wA7WDAOJShgMAQ==" crossorigin="anonymous"></script>
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/babel-standalone/7.24.5/babel.min.js" integrity="sha512-F62mvp9bPPLjVOpNlD+9erbo9KBRQKkLittcNub5D2o8WfgV9nrJR/0hKc1OUY3LNwlo671inEZzCjnLJz62nw==" crossorigin="anonymous"></script>
<style>
.field-label {
min-width: 80px;
14 changes: 13 additions & 1 deletion rules/fileperms.go
View file
Original file line number Diff line number Diff line change
@@ -61,14 +61,26 @@ func (r *filePermissions) Match(n ast.Node, c *gosec.Context) (*issue.Issue, err
for _, pkg := range r.pkgs {
if callexpr, matched := gosec.MatchCallByPackage(n, c, pkg, r.calls...); matched {
modeArg := callexpr.Args[len(callexpr.Args)-1]
if mode, err := gosec.GetInt(modeArg); err == nil && !modeIsSubset(mode, r.mode) {
if mode, err := gosec.GetInt(modeArg); err == nil && !modeIsSubset(mode, r.mode) || isOsPerm(modeArg) {
return c.NewIssue(n, r.ID(), r.What, r.Severity, r.Confidence), nil
}
}
}
return nil, nil
}

// isOsPerm check if the provide ast node contains a os.PermMode symbol
func isOsPerm(n ast.Node) bool {
if node, ok := n.(*ast.SelectorExpr); ok {
if identX, ok := node.X.(*ast.Ident); ok {
if identX.Name == "os" && node.Sel != nil && node.Sel.Name == "ModePerm" {
return true
}
}
}
return false
}

// NewWritePerms creates a rule to detect file Writes with bad permissions.
func NewWritePerms(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
mode := getConfiguredMode(conf, id, 0o600)
4 changes: 0 additions & 4 deletions rules/hardcoded_credentials.go
View file
Original file line number Diff line number Diff line change
@@ -153,10 +153,6 @@ var secretsPatterns = [...]secretPattern{
name: "Stripe API Key",
regexp: regexp.MustCompile(`sk_live_[0-9a-zA-Z]{24}`),
},
{
name: "Stripe API Key",
regexp: regexp.MustCompile(`sk_live_[0-9a-zA-Z]{24}`),
},
{
name: "Stripe Restricted API Key",
regexp: regexp.MustCompile(`rk_live_[0-9a-zA-Z]{24}`),
6 changes: 6 additions & 0 deletions rules/implicit_aliasing.go
View file
Original file line number Diff line number Diff line change
@@ -47,6 +47,12 @@ func doGetIdentExpr(expr ast.Expr, hasSelector bool) (*ast.Ident, bool) {
}

func (r *implicitAliasing) Match(n ast.Node, c *gosec.Context) (*issue.Issue, error) {
// This rule does not apply for Go 1.22, see https://tip.golang.org/doc/go1.22#language.
major, minor, _ := gosec.GoVersion()
if major >= 1 && minor >= 22 {
return nil, nil
}

switch node := n.(type) {
case *ast.RangeStmt:
// When presented with a range statement, get the underlying Object bound to
24 changes: 14 additions & 10 deletions rules/rand.go
View file
Original file line number Diff line number Diff line change
@@ -23,17 +23,16 @@ import (

type weakRand struct {
issue.MetaData
funcNames []string
packagePath string
blocklist map[string][]string
}

func (w *weakRand) ID() string {
return w.MetaData.ID
}

func (w *weakRand) Match(n ast.Node, c *gosec.Context) (*issue.Issue, error) {
for _, funcName := range w.funcNames {
if _, matched := gosec.MatchCallByPackage(n, c, w.packagePath, funcName); matched {
for pkg, funcs := range w.blocklist {
if _, matched := gosec.MatchCallByPackage(n, c, pkg, funcs...); matched {
return c.NewIssue(n, w.ID(), w.What, w.Severity, w.Confidence), nil
}
}
@@ -43,17 +42,22 @@ func (w *weakRand) Match(n ast.Node, c *gosec.Context) (*issue.Issue, error) {

// NewWeakRandCheck detects the use of random number generator that isn't cryptographically secure
func NewWeakRandCheck(id string, _ gosec.Config) (gosec.Rule, []ast.Node) {
calls := make(map[string][]string)
calls["math/rand"] = []string{
"New", "Read", "Float32", "Float64", "Int", "Int31", "Int31n",
"Int63", "Int63n", "Intn", "NormFloat64", "Uint32", "Uint64",
}
calls["math/rand/v2"] = []string{
"New", "Float32", "Float64", "Int", "Int32", "Int32N",
"Int64", "Int64N", "IntN", "N", "NormFloat64", "Uint32", "Uint32N", "Uint64", "Uint64N", "UintN",
}
return &weakRand{
funcNames: []string{
"New", "Read", "Float32", "Float64", "Int", "Int31",
"Int31n", "Int63", "Int63n", "Intn", "NormalFloat64", "Uint32", "Uint64",
},
packagePath: "math/rand",
blocklist: calls,
MetaData: issue.MetaData{
ID: id,
Severity: issue.High,
Confidence: issue.Medium,
What: "Use of weak random number generator (math/rand instead of crypto/rand)",
What: "Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand)",
},
}, []ast.Node{(*ast.CallExpr)(nil)}
}
1 change: 1 addition & 0 deletions rules/readfile.go
View file
Original file line number Diff line number Diff line change
@@ -143,6 +143,7 @@ func NewReadFile(id string, _ gosec.Config) (gosec.Rule, []ast.Node) {
rule.pathJoin.Add("path", "Join")
rule.clean.Add("path/filepath", "Clean")
rule.clean.Add("path/filepath", "Rel")
rule.clean.Add("path/filepath", "EvalSymlinks")
rule.Add("io/ioutil", "ReadFile")
rule.Add("os", "ReadFile")
rule.Add("os", "Open")
5 changes: 4 additions & 1 deletion rules/rules_test.go
View file
Original file line number Diff line number Diff line change
@@ -192,7 +192,10 @@ var _ = Describe("gosec rules", func() {
})

It("should detect implicit aliasing in ForRange", func() {
runner("G601", testutils.SampleCodeG601)
major, minor, _ := gosec.GoVersion()
if major <= 1 && minor < 22 {
runner("G601", testutils.SampleCodeG601)
}
})

It("should detect out of bounds slice access", func() {
21 changes: 20 additions & 1 deletion testutils/g306_samples.go
View file
Original file line number Diff line number Diff line change
@@ -21,7 +21,6 @@ func check(e error) {
}
func main() {
d1 := []byte("hello\ngo\n")
err := ioutil.WriteFile("/tmp/dat1", d1, 0744)
check(err)
@@ -52,5 +51,25 @@ func main() {
w.Flush()
}
`}, 1, gosec.NewConfig()},
{[]string{`
package main
import (
"io/ioutil"
"os"
)
func check(e error) {
if e != nil {
panic(e)
}
}
func main() {
content := []byte("hello\ngo\n")
err := ioutil.WriteFile("/tmp/dat1", content, os.ModePerm)
check(err)
}
`}, 1, gosec.NewConfig()},
}
85 changes: 85 additions & 0 deletions testutils/g404_samples.go
View file
Original file line number Diff line number Diff line change
@@ -27,6 +27,16 @@ func main() {
{[]string{`
package main
import "math/rand/v2"
func main() {
bad := rand.Int()
println(bad)
}
`}, 1, gosec.NewConfig()},
{[]string{`
package main
import (
"crypto/rand"
mrand "math/rand"
@@ -42,6 +52,21 @@ func main() {
{[]string{`
package main
import (
"crypto/rand"
mrand "math/rand/v2"
)
func main() {
good, _ := rand.Read(nil)
println(good)
bad := mrand.Int32()
println(bad)
}
`}, 1, gosec.NewConfig()},
{[]string{`
package main
import (
"math/rand"
)
@@ -55,6 +80,19 @@ func main() {
{[]string{`
package main
import (
"math/rand/v2"
)
func main() {
gen := rand.New(rand.NewPCG(1, 2))
bad := gen.Int()
println(bad)
}
`}, 1, gosec.NewConfig()},
{[]string{`
package main
import (
"math/rand"
)
@@ -67,6 +105,18 @@ func main() {
{[]string{`
package main
import (
"math/rand/v2"
)
func main() {
bad := rand.IntN(10)
println(bad)
}
`}, 1, gosec.NewConfig()},
{[]string{`
package main
import (
"crypto/rand"
"math/big"
@@ -83,6 +133,22 @@ func main() {
{[]string{`
package main
import (
"crypto/rand"
"math/big"
rnd "math/rand/v2"
)
func main() {
good, _ := rand.Int(rand.Reader, big.NewInt(int64(2)))
println(good)
bad := rnd.IntN(2)
println(bad)
}
`}, 1, gosec.NewConfig()},
{[]string{`
package main
import (
crand "crypto/rand"
"math/big"
@@ -98,5 +164,24 @@ func main() {
_ = rand2.Intn(2) // bad
_ = rand3.Intn(2) // bad
}
`}, 3, gosec.NewConfig()},
{[]string{`
package main
import (
crand "crypto/rand"
"math/big"
"math/rand/v2"
rand2 "math/rand/v2"
rand3 "math/rand/v2"
)
func main() {
_, _ = crand.Int(crand.Reader, big.NewInt(int64(2))) // good
_ = rand.IntN(2) // bad
_ = rand2.IntN(2) // bad
_ = rand3.IntN(2) // bad
}
`}, 3, gosec.NewConfig()},
}