Merge pull request #47 from gcmurphy/readme

Readme updates

README.md

@@ -4,6 +4,12 @@
 
 Inspects source code for security problems by scanning the Go AST.
 
+### License
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License [here](http://www.apache.org/licenses/LICENSE-2.0).
+
 ### Project status
 
 [![Build Status](https://travis-ci.org/HewlettPackard/gas.svg?branch=master)](https://travis-ci.org/HewlettPackard/gas)
@@ -20,34 +26,38 @@ directory you can supply './...' as the input argument.
 
 #### Selecting rules
 
-By default Gas will run all rules against the supplied file paths. It is however possible to select a subset of rules to run via the '-rule=' flag.
+By default Gas will run all rules against the supplied file paths. It is however possible to select a subset of rules to run via the '-include=' flag,
+or to specify a set of rules to explicitly exclude using the '-exclude=' flag.
 
 ##### Available rules
 
-- __crypto__ - Detects use of weak cryptography primitives.
+  - G101: Look for hardcoded credentials
-- __tls__ - Detects if TLS certificate verification is disabled.
+  - G102: Bind to all interfaces
-- __sql__ - SQL injection vectors.
+  - G103: Audit the use of unsafe block
-- __hardcoded__ - Potential hardcoded credentials.
+  - G104: Audit errors not checked
-- __perms__ - Insecure file permissions.
+  - G201: SQL query construction using format string
-- __tempfile__ - Insecure creation of temporary files
+  - G202: SQL query construction using string concatenation
-- __unsafe__- Detects use of the unsafe pointer functions.
+  - G203: Use of unescaped data in HTML templates
-- __bind__- Listening on all network interfaces.
+  - G204: Audit use of command execution
-- __rsa__- Warns for RSA keys that are less than 2048 bits.
+  - G301: Poor file permissions used when creating a directory
-- __tls_good__ - Checks to ensure ciphers and protocol versions are
+  - G302: Poor file permisions used with chmod
-explicitly enabled to meet the [modern compatibility](https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility) standards recommended by Mozilla.
+  - G303: Creating tempfile using a predictable path
-- __tls_ok__ - Checks to ensure ciphers and protocol versions are
+  - G401: Detect the usage of DES, RC4, or MD5
-explicitly enabled to meet the [intermediate compatibility]( https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29) standards recommended by Mozilla.
+  - G402: Look for bad TLS connection settings
-- __tls_old__ - Checks to ensure ciphers and protocol versions are
+  - G403: Ensure minimum RSA key length of 2048 bits
-explicitly enabled to meet the [older compatibility](https://wiki.mozilla.org/Security/Server_Side_TLS#Old_compatibility_.28default.29) standards recommended by Mozilla.
+  - G404: Insecure random number source (rand)
-- __templates__ - Detect cases where input is not escaped when entered into Go HTML templates.
+  - G501: Import blacklist: crypto/md5
-- __exec__ - Report cases where the application is executing an external process.
+  - G502: Import blacklist: crypto/des
-- __errors__ - Report error return values that are ignored.
+  - G503: Import blacklist: crypto/rc4
-- __httpoxy__ - Report on CGI usage as it may indicate vulnerability to the [httpoxy](https://httpoxy.org/) vulnerability.
+  - G504: Import blacklist: net/http/cgi
-
 
 
 ```
-$ gas -rule=rsa -rule=tls -rule=crypto ./...
+# Run a specific set of rules
+$ gas -include=G101,G203,G401 ./...
+
+# Run everything except for rule G303
+$ gas -exclude=G303 ./...
 ```
 
 #### Excluding files: