actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2025-02-28 20:23:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove the decryption funtions/methods from G407 check
Some checks failed
CI / test (map[go:1.22.9 golangci:latest]) (push) Has been cancelled
Details
CI / test (map[go:1.23.3 golangci:latest]) (push) Has been cancelled
Details
Security Scan / build (push) Has been cancelled
Details
CI / coverage (push) Has been cancelled
Details

Browse source 
The nonce in the decryption functions/methods is typically provided and
it should not be randomnly generated.

Change-Id: Id0df0d43aecb2aadb00b9fa901bd060a43a201c5
Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
This commit is contained in:
Cosmin Cojocar 2024-11-26 09:07:11 +00:00 committed by Cosmin Cojocar
parent 699cb55eb3
commit 229cf63a09
2 changed files with 11 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
analyzers/hardcodedNonce.go → analyzers/hardcoded_nonce.go
View file

@ -48,10 +48,7 @@ func runHardCodedNonce(pass *analysis.Pass) (interface{}, error) {
// Example "Test" 3, 1 -- means the function "Test" which accepts 3 arguments, and has the nonce arg as second argument // Example "Test" 3, 1 -- means the function "Test" which accepts 3 arguments, and has the nonce arg as second argument
calls := map[string][]int{ calls := map[string][]int{
"(crypto/cipher.AEAD).Seal": {4, 1}, "(crypto/cipher.AEAD).Seal": {4, 1},
"(crypto/cipher.AEAD).Open": {4, 1},
"crypto/cipher.NewCBCDecrypter": {2, 1},
"crypto/cipher.NewCBCEncrypter": {2, 1}, "crypto/cipher.NewCBCEncrypter": {2, 1},
"crypto/cipher.NewCFBDecrypter": {2, 1},
"crypto/cipher.NewCFBEncrypter": {2, 1}, "crypto/cipher.NewCFBEncrypter": {2, 1},
"crypto/cipher.NewCTR": {2, 1}, "crypto/cipher.NewCTR": {2, 1},
"crypto/cipher.NewOFB": {2, 1}, "crypto/cipher.NewOFB": {2, 1},

22
testutils/g407_samples.go
View file

@ -173,7 +173,7 @@ func main() {
cipherText, _ = aesGCM.Open(nil, []byte("ILoveMyNonce"), cipherText, nil) cipherText, _ = aesGCM.Open(nil, []byte("ILoveMyNonce"), cipherText, nil)
fmt.Println(string(cipherText)) fmt.Println(string(cipherText))
} }
`}, 2, gosec.NewConfig()}, `}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main
@ -193,7 +193,7 @@ func main() {
cipherText, _ = aesGCM.Open(nil, []byte{}, cipherText, nil) cipherText, _ = aesGCM.Open(nil, []byte{}, cipherText, nil)
fmt.Println(string(cipherText)) fmt.Println(string(cipherText))
} }
`}, 2, gosec.NewConfig()}, `}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main
@ -214,7 +214,7 @@ func main() {
cipherText, _ = aesGCM.Open(nil, []byte{1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1}, cipherText, nil) cipherText, _ = aesGCM.Open(nil, []byte{1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1}, cipherText, nil)
fmt.Println(string(cipherText)) fmt.Println(string(cipherText))
} }
`}, 2, gosec.NewConfig()}, `}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main
@ -248,7 +248,7 @@ func main() {
fmt.Println(string(cipherText)) fmt.Println(string(cipherText))
} }
`}, 2, gosec.NewConfig()}, `}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main
@ -281,7 +281,7 @@ func main() {
}(), cipherText, nil) }(), cipherText, nil)
fmt.Println(string(cipherText)) fmt.Println(string(cipherText))
} }
`}, 2, gosec.NewConfig()}, `}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main
@ -301,7 +301,7 @@ func main() {
fmt.Println(string(cipheredText)) fmt.Println(string(cipheredText))
} }
`}, 2, gosec.NewConfig()}, `}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main
@ -321,7 +321,7 @@ func main() {
fmt.Println(string(cipheredText)) fmt.Println(string(cipheredText))
} }
`}, 2, gosec.NewConfig()}, `}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main
@ -342,7 +342,7 @@ func main() {
aesCFB.XORKeyStream(output, output) aesCFB.XORKeyStream(output, output)
fmt.Println(string(output)) fmt.Println(string(output))
}`}, 2, gosec.NewConfig()}, }`}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main
@ -363,7 +363,7 @@ func main() {
aesCFB.XORKeyStream(output, output) aesCFB.XORKeyStream(output, output)
fmt.Println(string(output)) fmt.Println(string(output))
}`}, 2, gosec.NewConfig()}, }`}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main
@ -386,7 +386,7 @@ func main() {
aesCBC.CryptBlocks(output, output) aesCBC.CryptBlocks(output, output)
fmt.Println(string(output)) fmt.Println(string(output))
}`}, 2, gosec.NewConfig()}, }`}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main
@ -410,7 +410,7 @@ func main() {
fmt.Println(string(output)) fmt.Println(string(output))
} }
`}, 2, gosec.NewConfig()}, `}, 1, gosec.NewConfig()},
{[]string{`package main {[]string{`package main