actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-11-05 19:45:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #5 from HewlettPackard/docs

Browse source 
Update the README to include newer rules
This commit is contained in:
Grant Murphy 2016-07-22 07:55:53 -07:00 committed by GitHub
commit e2caa921fe
1 changed files with 25 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
README.md
View file

@ -15,15 +15,26 @@ By default Gas will run all rules against the supplied file paths. It is however
##### Available rules ##### Available rules
- __crypto__ - Detects use of weak cryptography primatives - __crypto__ - Detects use of weak cryptography primitives.
- __tls__ - Detects if TLS certificate verification is disabled - __tls__ - Detects if TLS certificate verification is disabled.
- __sql__ - SQL injection vectors - __sql__ - SQL injection vectors.
- __hardcoded__ - Potential hardcoded credentials - __hardcoded__ - Potential hardcoded credentials.
- __perms__ - Insecure file permissions - __perms__ - Insecure file permissions.
- __tempfile__ - Insecure creation of temporary files - __tempfile__ - Insecure creation of temporary files
- __unsafe__- Detects use of the unsafe pointer functions - __unsafe__- Detects use of the unsafe pointer functions.
- __bind__- Listening on all network interfaces - __bind__- Listening on all network interfaces.
- __rsa__- Weak RSA keys - __rsa__- Warns for RSA keys that are less than 2048 bits.
- __tls_good__ - Checks to ensure ciphers and protocol versions are
explicitly enabled to meet the [modern compatibility](https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility) standards recommended by Mozilla.
- __tls_ok__ - Checks to ensure ciphers and protocol versions are
explicitly enabled to meet the [intermediate compatibility]( https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29) standards recommended by Mozilla.
- __tls_old__ - Checks to ensure ciphers and protocol versions are
explicitly enabled to meet the [older compatibility](https://wiki.mozilla.org/Security/Server_Side_TLS#Old_compatibility_.28default.29) standards recommended by Mozilla.
- __templates__ - Detect cases where input is not escaped when entered into Go HTML templates.
- exec - Report cases where the application is executing an external process.
- __errors__ - Report error return values that are ignored.
- __httpoxy__ - Report on CGI usage as it may indicate vulnerability to the [httpoxy](https://httpoxy.org/) vulnerability.
``` ```
@ -54,7 +65,7 @@ import "md5" // #nosec
func main(){ func main(){
/* # nosec */ /* #nosec */
if x > y { if x > y {
h := md5.New() // this will also be ignored h := md5.New() // this will also be ignored
} }
@ -64,8 +75,8 @@ func main(){
``` ```
In some cases you may also want to revisit places where #nosec annotations In some cases you may also want to revisit places where #nosec annotations
have been used. To run the scanner and ignore any #nosec annotations you can have been used. To run the scanner and ignore any #nosec annotations you
do the following: can do the following:
``` ```
$ gas -nosec=true ./... $ gas -nosec=true ./...
@ -73,10 +84,9 @@ $ gas -nosec=true ./...
### Output formats ### Output formats
Gas currently supports text, json and csv output formats. By default results Gas currently supports text, json and csv output formats. By default
will be reported to stdout, but can also be written to an output file. The results will be reported to stdout, but can also be written to an output
output format is controlled by the '-fmt' flag, and the output file is file. The output format is controlled by the '-fmt' flag, and the output file is controlled by the '-out' flag as follows:
controlled by the '-out' flag as follows:
``` ```
# Write output in json format to results.json # Write output in json format to results.json