Change naming rule from blacklist to blocklist

README.md

@@ -114,11 +114,11 @@ directory you can supply `./...` as the input argument.
 - G402: Look for bad TLS connection settings
 - G403: Ensure minimum RSA key length of 2048 bits
 - G404: Insecure random number source (rand)
-- G501: Import blacklist: crypto/md5
+- G501: Import blocklist: crypto/md5
-- G502: Import blacklist: crypto/des
+- G502: Import blocklist: crypto/des
-- G503: Import blacklist: crypto/rc4
+- G503: Import blocklist: crypto/rc4
-- G504: Import blacklist: net/http/cgi
+- G504: Import blocklist: net/http/cgi
-- G505: Import blacklist: crypto/sha1
+- G505: Import blocklist: crypto/sha1
 - G601: Implicit memory aliasing of items from a range statement
 
 ### Retired rules

rules/blacklist.go

@@ -21,9 +21,9 @@ import (
 	"github.com/securego/gosec/v2"
 )
 
-type blacklistedImport struct {
+type blocklistedImport struct {
 	gosec.MetaData
-	Blacklisted map[string]string
+	Blocklisted map[string]string
 }
 
 func unquote(original string) string {
@@ -32,63 +32,63 @@ func unquote(original string) string {
 	return strings.TrimRight(copy, `"`)
 }
 
-func (r *blacklistedImport) ID() string {
+func (r *blocklistedImport) ID() string {
 	return r.MetaData.ID
 }
 
-func (r *blacklistedImport) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) {
+func (r *blocklistedImport) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) {
 	if node, ok := n.(*ast.ImportSpec); ok {
-		if description, ok := r.Blacklisted[unquote(node.Path.Value)]; ok {
+		if description, ok := r.Blocklisted[unquote(node.Path.Value)]; ok {
 			return gosec.NewIssue(c, node, r.ID(), description, r.Severity, r.Confidence), nil
 		}
 	}
 	return nil, nil
 }
 
-// NewBlacklistedImports reports when a blacklisted import is being used.
+// NewBlocklistedImports reports when a blocklisted import is being used.
 // Typically when a deprecated technology is being used.
-func NewBlacklistedImports(id string, conf gosec.Config, blacklist map[string]string) (gosec.Rule, []ast.Node) {
+func NewBlocklistedImports(id string, conf gosec.Config, blocklist map[string]string) (gosec.Rule, []ast.Node) {
-	return &blacklistedImport{
+	return &blocklistedImport{
 		MetaData: gosec.MetaData{
 			ID:         id,
 			Severity:   gosec.Medium,
 			Confidence: gosec.High,
 		},
-		Blacklisted: blacklist,
+		Blocklisted: blocklist,
 	}, []ast.Node{(*ast.ImportSpec)(nil)}
 }
 
-// NewBlacklistedImportMD5 fails if MD5 is imported
+// NewBlocklistedImportMD5 fails if MD5 is imported
-func NewBlacklistedImportMD5(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
+func NewBlocklistedImportMD5(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
-	return NewBlacklistedImports(id, conf, map[string]string{
+	return NewBlocklistedImports(id, conf, map[string]string{
-		"crypto/md5": "Blacklisted import crypto/md5: weak cryptographic primitive",
+		"crypto/md5": "Blocklisted import crypto/md5: weak cryptographic primitive",
 	})
 }
 
-// NewBlacklistedImportDES fails if DES is imported
+// NewBlocklistedImportDES fails if DES is imported
-func NewBlacklistedImportDES(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
+func NewBlocklistedImportDES(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
-	return NewBlacklistedImports(id, conf, map[string]string{
+	return NewBlocklistedImports(id, conf, map[string]string{
-		"crypto/des": "Blacklisted import crypto/des: weak cryptographic primitive",
+		"crypto/des": "Blocklisted import crypto/des: weak cryptographic primitive",
 	})
 }
 
-// NewBlacklistedImportRC4 fails if DES is imported
+// NewBlocklistedImportRC4 fails if DES is imported
-func NewBlacklistedImportRC4(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
+func NewBlocklistedImportRC4(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
-	return NewBlacklistedImports(id, conf, map[string]string{
+	return NewBlocklistedImports(id, conf, map[string]string{
-		"crypto/rc4": "Blacklisted import crypto/rc4: weak cryptographic primitive",
+		"crypto/rc4": "Blocklisted import crypto/rc4: weak cryptographic primitive",
 	})
 }
 
-// NewBlacklistedImportCGI fails if CGI is imported
+// NewBlocklistedImportCGI fails if CGI is imported
-func NewBlacklistedImportCGI(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
+func NewBlocklistedImportCGI(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
-	return NewBlacklistedImports(id, conf, map[string]string{
+	return NewBlocklistedImports(id, conf, map[string]string{
-		"net/http/cgi": "Blacklisted import net/http/cgi: Go versions < 1.6.3 are vulnerable to Httpoxy attack: (CVE-2016-5386)",
+		"net/http/cgi": "Blocklisted import net/http/cgi: Go versions < 1.6.3 are vulnerable to Httpoxy attack: (CVE-2016-5386)",
 	})
 }
 
-// NewBlacklistedImportSHA1 fails if SHA1 is imported
+// NewBlocklistedImportSHA1 fails if SHA1 is imported
-func NewBlacklistedImportSHA1(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
+func NewBlocklistedImportSHA1(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
-	return NewBlacklistedImports(id, conf, map[string]string{
+	return NewBlocklistedImports(id, conf, map[string]string{
-		"crypto/sha1": "Blacklisted import crypto/sha1: weak cryptographic primitive",
+		"crypto/sha1": "Blocklisted import crypto/sha1: weak cryptographic primitive",
 	})
 }

rules/rulelist.go

@@ -90,12 +90,12 @@ func Generate(filters ...RuleFilter) RuleList {
 		{"G403", "Ensure minimum RSA key length of 2048 bits", NewWeakKeyStrength},
 		{"G404", "Insecure random number source (rand)", NewWeakRandCheck},
 
-		// blacklist
+		// blocklist
-		{"G501", "Import blacklist: crypto/md5", NewBlacklistedImportMD5},
+		{"G501", "Import blocklist: crypto/md5", NewBlocklistedImportMD5},
-		{"G502", "Import blacklist: crypto/des", NewBlacklistedImportDES},
+		{"G502", "Import blocklist: crypto/des", NewBlocklistedImportDES},
-		{"G503", "Import blacklist: crypto/rc4", NewBlacklistedImportRC4},
+		{"G503", "Import blocklist: crypto/rc4", NewBlocklistedImportRC4},
-		{"G504", "Import blacklist: net/http/cgi", NewBlacklistedImportCGI},
+		{"G504", "Import blocklist: net/http/cgi", NewBlocklistedImportCGI},
-		{"G505", "Import blacklist: crypto/sha1", NewBlacklistedImportSHA1},
+		{"G505", "Import blocklist: crypto/sha1", NewBlocklistedImportSHA1},
 
 		// memory safety
 		{"G601", "Implicit memory aliasing in RangeStmt", NewImplicitAliasing},

rules/rules_test.go

@@ -155,23 +155,23 @@ var _ = Describe("gosec rules", func() {
 			runner("G404", testutils.SampleCodeG404)
 		})
 
-		It("should detect blacklisted imports - MD5", func() {
+		It("should detect blocklisted imports - MD5", func() {
 			runner("G501", testutils.SampleCodeG501)
 		})
 
-		It("should detect blacklisted imports - DES", func() {
+		It("should detect blocklisted imports - DES", func() {
 			runner("G502", testutils.SampleCodeG502)
 		})
 
-		It("should detect blacklisted imports - RC4", func() {
+		It("should detect blocklisted imports - RC4", func() {
 			runner("G503", testutils.SampleCodeG503)
 		})
 
-		It("should detect blacklisted imports - CGI (httpoxy)", func() {
+		It("should detect blocklisted imports - CGI (httpoxy)", func() {
 			runner("G504", testutils.SampleCodeG504)
 		})
 
-		It("should detect blacklisted imports - SHA1", func() {
+		It("should detect blocklisted imports - SHA1", func() {
 			runner("G505", testutils.SampleCodeG505)
 		})
 

rules/weakcrypto.go

@@ -22,7 +22,7 @@ import (
 
 type usesWeakCryptography struct {
 	gosec.MetaData
-	blacklist map[string][]string
+	blocklist map[string][]string
 }
 
 func (r *usesWeakCryptography) ID() string {
@@ -30,7 +30,7 @@ func (r *usesWeakCryptography) ID() string {
 }
 
 func (r *usesWeakCryptography) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) {
-	for pkg, funcs := range r.blacklist {
+	for pkg, funcs := range r.blocklist {
 		if _, matched := gosec.MatchCallByPackage(n, c, pkg, funcs...); matched {
 			return gosec.NewIssue(c, n, r.ID(), r.What, r.Severity, r.Confidence), nil
 		}
@@ -46,7 +46,7 @@ func NewUsesWeakCryptography(id string, conf gosec.Config) (gosec.Rule, []ast.No
 	calls["crypto/sha1"] = []string{"New", "Sum"}
 	calls["crypto/rc4"] = []string{"NewCipher"}
 	rule := &usesWeakCryptography{
-		blacklist: calls,
+		blocklist: calls,
 		MetaData: gosec.MetaData{
 			ID:         id,
 			Severity:   gosec.Medium,

testutils/source.go

@@ -1973,7 +1973,7 @@ func main() {
 	println(bad)
 }`}, 1, gosec.NewConfig()}}
 
-	// SampleCodeG501 - Blacklisted import MD5
+	// SampleCodeG501 - Blocklisted import MD5
 	SampleCodeG501 = []CodeSample{
 		{[]string{`
 package main
@@ -1988,7 +1988,7 @@ func main() {
 	}
 }`}, 1, gosec.NewConfig()}}
 
-	// SampleCodeG502 - Blacklisted import DES
+	// SampleCodeG502 - Blocklisted import DES
 	SampleCodeG502 = []CodeSample{
 		{[]string{`
 package main
@@ -2016,7 +2016,7 @@ func main() {
 	fmt.Println("Secret message is: %s", hex.EncodeToString(ciphertext))
 }`}, 1, gosec.NewConfig()}}
 
-	// SampleCodeG503 - Blacklisted import RC4
+	// SampleCodeG503 - Blocklisted import RC4
 	SampleCodeG503 = []CodeSample{{[]string{`
 package main
 import (
@@ -2035,7 +2035,7 @@ func main() {
 	fmt.Println("Secret message is: %s", hex.EncodeToString(ciphertext))
 }`}, 1, gosec.NewConfig()}}
 
-	// SampleCodeG504 - Blacklisted import CGI
+	// SampleCodeG504 - Blocklisted import CGI
 	SampleCodeG504 = []CodeSample{{[]string{`
 package main
 import (
@@ -2045,7 +2045,7 @@ import (
 func main() {
 	cgi.Serve(http.FileServer(http.Dir("/usr/share/doc")))
 }`}, 1, gosec.NewConfig()}}
-	// SampleCodeG505 - Blacklisted import SHA1
+	// SampleCodeG505 - Blocklisted import SHA1
 	SampleCodeG505 = []CodeSample{
 		{[]string{`
 package main