actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-12-25 03:55:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update README.md to use rule ID's

Browse source
This commit is contained in:
Grant Murphy 2016-08-28 11:07:28 -07:00
parent 37205e9afa
commit 929edb490a
1 changed files with 26 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
README.md
View file

@ -20,34 +20,38 @@ directory you can supply './...' as the input argument.
#### Selecting rules #### Selecting rules
By default Gas will run all rules against the supplied file paths. It is however possible to select a subset of rules to run via the '-rule=' flag. By default Gas will run all rules against the supplied file paths. It is however possible to select a subset of rules to run via the '-include=' flag,
or to specify a set of rules to explicitly exclude using the '-exclude=' flag.
##### Available rules ##### Available rules
- __crypto__ - Detects use of weak cryptography primitives. - G101: Look for hardcoded credentials
- __tls__ - Detects if TLS certificate verification is disabled. - G102: Bind to all interfaces
- __sql__ - SQL injection vectors. - G103: Audit the use of unsafe block
- __hardcoded__ - Potential hardcoded credentials. - G104: Audit errors not checked
- __perms__ - Insecure file permissions. - G201: SQL query construction using format string
- __tempfile__ - Insecure creation of temporary files - G202: SQL query construction using string concatenation
- __unsafe__- Detects use of the unsafe pointer functions. - G203: Use of unescaped data in HTML templates
- __bind__- Listening on all network interfaces. - G204: Audit use of command execution
- __rsa__- Warns for RSA keys that are less than 2048 bits. - G301: Poor file permissions used when creating a directory
- __tls_good__ - Checks to ensure ciphers and protocol versions are - G302: Poor file permisions used with chmod
explicitly enabled to meet the [modern compatibility](https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility) standards recommended by Mozilla. - G303: Creating tempfile using a predictable path
- __tls_ok__ - Checks to ensure ciphers and protocol versions are - G401: Detect the usage of DES, RC4, or MD5
explicitly enabled to meet the [intermediate compatibility]( https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29) standards recommended by Mozilla. - G402: Look for bad TLS connection settings
- __tls_old__ - Checks to ensure ciphers and protocol versions are - G403: Ensure minimum RSA key length of 2048 bits
explicitly enabled to meet the [older compatibility](https://wiki.mozilla.org/Security/Server_Side_TLS#Old_compatibility_.28default.29) standards recommended by Mozilla. - G404: Insecure random number source (rand)
- __templates__ - Detect cases where input is not escaped when entered into Go HTML templates. - G501: Import blacklist: crypto/md5
- __exec__ - Report cases where the application is executing an external process. - G502: Import blacklist: crypto/des
- __errors__ - Report error return values that are ignored. - G503: Import blacklist: crypto/rc4
- __httpoxy__ - Report on CGI usage as it may indicate vulnerability to the [httpoxy](https://httpoxy.org/) vulnerability. - G504: Import blacklist: net/http/cgi
``` ```
$ gas -rule=rsa -rule=tls -rule=crypto ./... # Run a specific set of rules
$ gas -include=G101,G203,G401 ./...
# Run everything except for rule G303
$ gas -exclude=G303 ./...
``` ```
#### Excluding files: #### Excluding files: