mirror of
https://github.com/securego/gosec.git
synced 2025-01-11 20:35:52 +00:00
Refactor the rules tests to be able to configure the analyzer config per test sample
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
This commit is contained in:
Cosmin Cojocar
parent
36a82ea85e
commit
ed9934fa48
3 changed files with 82 additions and 81 deletions
|
|
@ -92,6 +92,11 @@ func NewAnalyzer(conf Config, tests bool, logger *log.Logger) *Analyzer {
|
|||
}
|
||||
}
|
||||
|
||||
// SetConfig upates the analyzer configuration
|
||||
func (gosec *Analyzer) SetConfig(conf Config) {
|
||||
gosec.config = conf
|
||||
}
|
||||
|
||||
// LoadRules instantiates all the rules to be used when analyzing source
|
||||
// packages
|
||||
func (gosec *Analyzer) LoadRules(ruleDefinitions map[string]RuleBuilder) {
|
||||
|
|
|
|||
|
|
@ -12,18 +12,13 @@ import (
|
|||
"github.com/securego/gosec/testutils"
|
||||
)
|
||||
|
||||
type option struct {
|
||||
name gosec.GlobalOption
|
||||
value string
|
||||
}
|
||||
|
||||
var _ = Describe("gosec rules", func() {
|
||||
|
||||
var (
|
||||
logger *log.Logger
|
||||
config gosec.Config
|
||||
analyzer *gosec.Analyzer
|
||||
runner func(string, []testutils.CodeSample, ...option)
|
||||
runner func(string, []testutils.CodeSample)
|
||||
buildTags []string
|
||||
tests bool
|
||||
)
|
||||
|
|
@ -32,13 +27,11 @@ var _ = Describe("gosec rules", func() {
|
|||
logger, _ = testutils.NewLogger()
|
||||
config = gosec.NewConfig()
|
||||
analyzer = gosec.NewAnalyzer(config, tests, logger)
|
||||
runner = func(rule string, samples []testutils.CodeSample, options ...option) {
|
||||
for _, o := range options {
|
||||
config.SetGlobal(o.name, o.value)
|
||||
}
|
||||
runner = func(rule string, samples []testutils.CodeSample) {
|
||||
analyzer.LoadRules(rules.Generate(rules.NewRuleFilter(false, rule)).Builders())
|
||||
for n, sample := range samples {
|
||||
analyzer.Reset()
|
||||
analyzer.SetConfig(sample.Config)
|
||||
pkg := testutils.NewTestPackage()
|
||||
defer pkg.Close()
|
||||
for i, code := range sample.Code {
|
||||
|
|
@ -75,7 +68,7 @@ var _ = Describe("gosec rules", func() {
|
|||
})
|
||||
|
||||
It("should detect errors not being checked in audit mode", func() {
|
||||
runner("G104", testutils.SampleCodeG104Audit, option{name: gosec.Audit, value: "enabled"})
|
||||
runner("G104", testutils.SampleCodeG104Audit)
|
||||
})
|
||||
|
||||
It("should detect of big.Exp function", func() {
|
||||
|
|
|
|||
|
|
@ -1,9 +1,12 @@
|
|||
package testutils
|
||||
|
||||
import "github.com/securego/gosec"
|
||||
|
||||
// CodeSample encapsulates a snippet of source code that compiles, and how many errors should be detected
|
||||
type CodeSample struct {
|
||||
Code []string
|
||||
Errors int
|
||||
Config gosec.Config
|
||||
}
|
||||
|
||||
var (
|
||||
|
|
@ -15,7 +18,7 @@ func main() {
|
|||
username := "admin"
|
||||
password := "f62e5bcda4fae4f82370da0c6f20697b8f8447ef"
|
||||
fmt.Println("Doing something with: ", username, password)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
// Entropy check should not report this error by default
|
||||
package main
|
||||
import "fmt"
|
||||
|
|
@ -23,21 +26,21 @@ func main() {
|
|||
username := "admin"
|
||||
password := "secret"
|
||||
fmt.Println("Doing something with: ", username, password)
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import "fmt"
|
||||
var password = "f62e5bcda4fae4f82370da0c6f20697b8f8447ef"
|
||||
func main() {
|
||||
username := "admin"
|
||||
fmt.Println("Doing something with: ", username, password)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import "fmt"
|
||||
const password = "f62e5bcda4fae4f82370da0c6f20697b8f8447ef"
|
||||
func main() {
|
||||
username := "admin"
|
||||
fmt.Println("Doing something with: ", username, password)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import "fmt"
|
||||
const (
|
||||
|
|
@ -46,12 +49,12 @@ const (
|
|||
)
|
||||
func main() {
|
||||
fmt.Println("Doing something with: ", username, password)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
var password string
|
||||
func init() {
|
||||
password = "f62e5bcda4fae4f82370da0c6f20697b8f8447ef"
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
const (
|
||||
ATNStateSomethingElse = 1
|
||||
|
|
@ -59,14 +62,14 @@ const (
|
|||
)
|
||||
func main() {
|
||||
println(ATNStateTokenStart)
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
const (
|
||||
ATNStateTokenStart = "f62e5bcda4fae4f82370da0c6f20697b8f8447ef"
|
||||
)
|
||||
func main() {
|
||||
println(ATNStateTokenStart)
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG102 code snippets for network binding
|
||||
SampleCodeG102 = []CodeSample{
|
||||
|
|
@ -83,7 +86,7 @@ func main() {
|
|||
log.Fatal(err)
|
||||
}
|
||||
defer l.Close()
|
||||
}`}, 1},
|
||||
}`}, 1, gosec.NewConfig()},
|
||||
|
||||
// Bind to all networks implicitly (default if host omitted)
|
||||
{[]string{`
|
||||
|
|
@ -98,7 +101,7 @@ func main() {
|
|||
log.Fatal(err)
|
||||
}
|
||||
defer l.Close()
|
||||
}`}, 1},
|
||||
}`}, 1, gosec.NewConfig()},
|
||||
// Bind to all networks indirectly through a parsing function
|
||||
{[]string{`
|
||||
package main
|
||||
|
|
@ -116,7 +119,7 @@ func main() {
|
|||
log.Fatal(err)
|
||||
}
|
||||
defer l.Close()
|
||||
}`}, 1},
|
||||
}`}, 1, gosec.NewConfig()},
|
||||
// Bind to all networks indirectly through a parsing function
|
||||
{[]string{`
|
||||
package main
|
||||
|
|
@ -134,7 +137,7 @@ func main() {
|
|||
log.Fatal(err)
|
||||
}
|
||||
defer l.Close()
|
||||
}`}, 1},
|
||||
}`}, 1, gosec.NewConfig()},
|
||||
{[]string{`
|
||||
package main
|
||||
import (
|
||||
|
|
@ -149,7 +152,7 @@ func main() {
|
|||
log.Fatal(err)
|
||||
}
|
||||
defer l.Close()
|
||||
}`}, 1},
|
||||
}`}, 1, gosec.NewConfig()},
|
||||
}
|
||||
// SampleCodeG103 find instances of unsafe blocks for auditing purposes
|
||||
SampleCodeG103 = []CodeSample{
|
||||
|
|
@ -171,7 +174,7 @@ func main() {
|
|||
addressHolder := uintptr(unsafe.Pointer(intPtr)) + unsafe.Sizeof(intArray[0])
|
||||
intPtr = (*int)(unsafe.Pointer(addressHolder))
|
||||
fmt.Printf("\nintPtr=%p, *intPtr=%d.\n\n", intPtr, *intPtr)
|
||||
}`}, 3}}
|
||||
}`}, 3, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG104 finds errors that aren't being handled
|
||||
SampleCodeG104 = []CodeSample{
|
||||
|
|
@ -184,7 +187,7 @@ func test() (int,error) {
|
|||
func main() {
|
||||
v, _ := test()
|
||||
fmt.Println(v)
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import (
|
||||
"io/ioutil"
|
||||
|
|
@ -206,7 +209,7 @@ func main() {
|
|||
a()
|
||||
b()
|
||||
c()
|
||||
}`}, 2}, {[]string{`
|
||||
}`}, 2, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import "fmt"
|
||||
func test() error {
|
||||
|
|
@ -215,7 +218,7 @@ func test() error {
|
|||
func main() {
|
||||
e := test()
|
||||
fmt.Println(e)
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
// +build go1.10
|
||||
|
||||
package main
|
||||
|
|
@ -229,7 +232,7 @@ func main() {
|
|||
}`, `
|
||||
package main
|
||||
func dummy(){}
|
||||
`}, 0}}
|
||||
`}, 0, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG104Audit finds errors that aren't being handled in audit mode
|
||||
SampleCodeG104Audit = []CodeSample{
|
||||
|
|
@ -242,7 +245,7 @@ func test() (int,error) {
|
|||
func main() {
|
||||
v, _ := test()
|
||||
fmt.Println(v)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.Config{gosec.Globals: map[gosec.GlobalOption]string{gosec.Audit: "enabled"}}}, {[]string{`
|
||||
package main
|
||||
import (
|
||||
"io/ioutil"
|
||||
|
|
@ -264,7 +267,7 @@ func main() {
|
|||
a()
|
||||
b()
|
||||
c()
|
||||
}`}, 3}, {[]string{`
|
||||
}`}, 3, gosec.Config{gosec.Globals: map[gosec.GlobalOption]string{gosec.Audit: "enabled"}}}, {[]string{`
|
||||
package main
|
||||
import "fmt"
|
||||
func test() error {
|
||||
|
|
@ -273,7 +276,7 @@ func test() error {
|
|||
func main() {
|
||||
e := test()
|
||||
fmt.Println(e)
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.Config{gosec.Globals: map[gosec.GlobalOption]string{gosec.Audit: "enabled"}}}, {[]string{`
|
||||
// +build go1.10
|
||||
|
||||
package main
|
||||
|
|
@ -287,7 +290,7 @@ func main() {
|
|||
}`, `
|
||||
package main
|
||||
func dummy(){}
|
||||
`}, 0}}
|
||||
`}, 0, gosec.Config{gosec.Globals: map[gosec.GlobalOption]string{gosec.Audit: "enabled"}}}}
|
||||
// SampleCodeG105 - bignum overflow
|
||||
SampleCodeG105 = []CodeSample{{[]string{`
|
||||
package main
|
||||
|
|
@ -303,7 +306,7 @@ func main() {
|
|||
m := new(big.Int)
|
||||
m = m.SetUint64(0)
|
||||
z = z.Exp(x, y, m)
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG106 - ssh InsecureIgnoreHostKey
|
||||
SampleCodeG106 = []CodeSample{{[]string{`
|
||||
|
|
@ -313,7 +316,7 @@ import (
|
|||
)
|
||||
func main() {
|
||||
_ = ssh.InsecureIgnoreHostKey()
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG107 - SSRF via http requests with variable url
|
||||
SampleCodeG107 = []CodeSample{{[]string{`
|
||||
|
|
@ -341,7 +344,7 @@ func main() {
|
|||
panic(err)
|
||||
}
|
||||
fmt.Printf("%s", body)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
|
||||
import (
|
||||
|
|
@ -355,7 +358,7 @@ func main() {
|
|||
fmt.Println(err)
|
||||
}
|
||||
fmt.Println(resp.Status)
|
||||
}`}, 0}}
|
||||
}`}, 0, gosec.NewConfig()}}
|
||||
// SampleCodeG201 - SQL injection via format string
|
||||
SampleCodeG201 = []CodeSample{
|
||||
{[]string{`
|
||||
|
|
@ -378,7 +381,7 @@ func main(){
|
|||
panic(err)
|
||||
}
|
||||
defer rows.Close()
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
// Format string false positive, safe string spec.
|
||||
package main
|
||||
import (
|
||||
|
|
@ -398,7 +401,7 @@ func main(){
|
|||
panic(err)
|
||||
}
|
||||
defer rows.Close()
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
// Format string false positive
|
||||
package main
|
||||
import (
|
||||
|
|
@ -415,7 +418,7 @@ func main(){
|
|||
panic(err)
|
||||
}
|
||||
defer rows.Close()
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
// Format string false positive, quoted formatter argument.
|
||||
package main
|
||||
import (
|
||||
|
|
@ -436,7 +439,7 @@ func main(){
|
|||
panic(err)
|
||||
}
|
||||
defer rows.Close()
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
// false positive
|
||||
package main
|
||||
import (
|
||||
|
|
@ -456,7 +459,7 @@ func main(){
|
|||
panic(err)
|
||||
}
|
||||
defer rows.Close()
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import (
|
||||
"fmt"
|
||||
|
|
@ -464,7 +467,7 @@ import (
|
|||
|
||||
func main(){
|
||||
fmt.Sprintln()
|
||||
}`}, 0}}
|
||||
}`}, 0, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG202 - SQL query string building via string concatenation
|
||||
SampleCodeG202 = []CodeSample{
|
||||
|
|
@ -484,7 +487,7 @@ func main(){
|
|||
panic(err)
|
||||
}
|
||||
defer rows.Close()
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
// false positive
|
||||
package main
|
||||
import (
|
||||
|
|
@ -501,7 +504,7 @@ func main(){
|
|||
panic(err)
|
||||
}
|
||||
defer rows.Close()
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import (
|
||||
"database/sql"
|
||||
|
|
@ -519,7 +522,7 @@ func main(){
|
|||
}
|
||||
defer rows.Close()
|
||||
}
|
||||
`}, 0}, {[]string{`
|
||||
`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
const gender = "M"
|
||||
`, `
|
||||
|
|
@ -540,7 +543,7 @@ func main(){
|
|||
}
|
||||
defer rows.Close()
|
||||
}
|
||||
`}, 0}}
|
||||
`}, 0, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG203 - Template checks
|
||||
SampleCodeG203 = []CodeSample{
|
||||
|
|
@ -560,7 +563,7 @@ func main() {
|
|||
"Body": template.HTML("<script>alert(1)</script>"),
|
||||
}
|
||||
t.Execute(os.Stdout, v)
|
||||
}`}, 0}, {[]string{
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{
|
||||
`
|
||||
// Using a variable to initialize could potentially be dangerous. Under the
|
||||
// current model this will likely produce some false positives.
|
||||
|
|
@ -578,7 +581,7 @@ func main() {
|
|||
"Body": template.HTML(a),
|
||||
}
|
||||
t.Execute(os.Stdout, v)
|
||||
}`}, 1}, {[]string{
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{
|
||||
`
|
||||
package main
|
||||
import (
|
||||
|
|
@ -594,7 +597,7 @@ func main() {
|
|||
"Body": template.JS(a),
|
||||
}
|
||||
t.Execute(os.Stdout, v)
|
||||
}`}, 1}, {[]string{
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{
|
||||
`
|
||||
package main
|
||||
import (
|
||||
|
|
@ -610,7 +613,7 @@ func main() {
|
|||
"Body": template.URL(a),
|
||||
}
|
||||
t.Execute(os.Stdout, v)
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG204 - Subprocess auditing
|
||||
SampleCodeG204 = []CodeSample{{[]string{`
|
||||
|
|
@ -618,7 +621,7 @@ package main
|
|||
import "syscall"
|
||||
func main() {
|
||||
syscall.Exec("/bin/cat", []string{ "/etc/passwd" }, nil)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import (
|
||||
"log"
|
||||
|
|
@ -633,7 +636,7 @@ func main() {
|
|||
log.Printf("Waiting for command to finish...")
|
||||
err = cmd.Wait()
|
||||
log.Printf("Command finished with error: %v", err)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import (
|
||||
"log"
|
||||
|
|
@ -646,7 +649,7 @@ func main() {
|
|||
log.Fatal(err)
|
||||
}
|
||||
log.Printf("Command finished with error: %v", err)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import (
|
||||
"log"
|
||||
|
|
@ -663,7 +666,7 @@ func main() {
|
|||
log.Printf("Waiting for command to finish...")
|
||||
err = cmd.Wait()
|
||||
log.Printf("Command finished with error: %v", err)
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG301 - mkdir permission check
|
||||
SampleCodeG301 = []CodeSample{{[]string{`
|
||||
|
|
@ -673,7 +676,7 @@ func main() {
|
|||
os.Mkdir("/tmp/mydir", 0777)
|
||||
os.Mkdir("/tmp/mydir", 0600)
|
||||
os.MkdirAll("/tmp/mydir/mysubidr", 0775)
|
||||
}`}, 2}}
|
||||
}`}, 2, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG302 - file create / chmod permissions check
|
||||
SampleCodeG302 = []CodeSample{{[]string{`
|
||||
|
|
@ -684,7 +687,7 @@ func main() {
|
|||
os.Chmod("/tmp/someotherfile", 0600)
|
||||
os.OpenFile("/tmp/thing", os.O_CREATE|os.O_WRONLY, 0666)
|
||||
os.OpenFile("/tmp/thing", os.O_CREATE|os.O_WRONLY, 0600)
|
||||
}`}, 2}}
|
||||
}`}, 2, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG303 - bad tempfile permissions & hardcoded shared path
|
||||
SampleCodeG303 = []CodeSample{{[]string{`
|
||||
|
|
@ -697,7 +700,7 @@ func main() {
|
|||
file1, _ := os.Create("/tmp/demo1")
|
||||
defer file1.Close()
|
||||
ioutil.WriteFile("/tmp/demo2", []byte("This is some data"), 0644)
|
||||
}`}, 2}}
|
||||
}`}, 2, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG304 - potential file inclusion vulnerability
|
||||
SampleCodeG304 = []CodeSample{{[]string{`
|
||||
|
|
@ -715,7 +718,7 @@ if err != nil {
|
|||
}
|
||||
log.Print(body)
|
||||
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
|
||||
import (
|
||||
|
|
@ -739,7 +742,7 @@ func main() {
|
|||
fmt.Fprintf(w, "%s", body)
|
||||
})
|
||||
log.Fatal(http.ListenAndServe(":3000", nil))
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
|
||||
import (
|
||||
|
|
@ -755,7 +758,7 @@ import (
|
|||
log.Printf("Error: %v\n", err)
|
||||
}
|
||||
log.Print(body)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
|
||||
import (
|
||||
|
|
@ -779,7 +782,7 @@ func main() {
|
|||
fmt.Printf("Error: %v\n", err)
|
||||
}
|
||||
fmt.Println(string(contents))
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
|
||||
import (
|
||||
|
|
@ -798,7 +801,7 @@ func main() {
|
|||
log.Printf("Error: %v\n", err)
|
||||
}
|
||||
log.Print(body)
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG305 - File path traversal when extracting zip archives
|
||||
SampleCodeG305 = []CodeSample{{[]string{`
|
||||
|
|
@ -846,7 +849,7 @@ func unzip(archive, target string) error {
|
|||
}
|
||||
|
||||
return nil
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package unzip
|
||||
|
||||
import (
|
||||
|
|
@ -892,7 +895,7 @@ func unzip(archive, target string) error {
|
|||
}
|
||||
|
||||
return nil
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG401 - Use of weak crypto MD5
|
||||
SampleCodeG401 = []CodeSample{
|
||||
|
|
@ -917,7 +920,7 @@ func main() {
|
|||
log.Fatal(err)
|
||||
}
|
||||
fmt.Printf("%x", h.Sum(nil))
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG401b - Use of weak crypto SHA1
|
||||
SampleCodeG401b = []CodeSample{
|
||||
|
|
@ -942,7 +945,7 @@ func main() {
|
|||
log.Fatal(err)
|
||||
}
|
||||
fmt.Printf("%x", h.Sum(nil))
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG402 - TLS settings
|
||||
SampleCodeG402 = []CodeSample{{[]string{`
|
||||
|
|
@ -963,7 +966,7 @@ func main() {
|
|||
if err != nil {
|
||||
fmt.Println(err)
|
||||
}
|
||||
}`}, 1}, {[]string{
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{
|
||||
`
|
||||
// Insecure minimum version
|
||||
package main
|
||||
|
|
@ -981,7 +984,7 @@ func main() {
|
|||
if err != nil {
|
||||
fmt.Println(err)
|
||||
}
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
// Insecure max version
|
||||
package main
|
||||
import (
|
||||
|
|
@ -999,7 +1002,7 @@ func main() {
|
|||
fmt.Println(err)
|
||||
}
|
||||
}
|
||||
`}, 1}, {
|
||||
`}, 1, gosec.NewConfig()}, {
|
||||
[]string{`
|
||||
// Insecure ciphersuite selection
|
||||
package main
|
||||
|
|
@ -1020,7 +1023,7 @@ func main() {
|
|||
if err != nil {
|
||||
fmt.Println(err)
|
||||
}
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG403 - weak key strength
|
||||
SampleCodeG403 = []CodeSample{
|
||||
|
|
@ -1038,7 +1041,7 @@ func main() {
|
|||
fmt.Println(err)
|
||||
}
|
||||
fmt.Println(pvk)
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG404 - weak random number
|
||||
SampleCodeG404 = []CodeSample{
|
||||
|
|
@ -1048,13 +1051,13 @@ import "crypto/rand"
|
|||
func main() {
|
||||
good, _ := rand.Read(nil)
|
||||
println(good)
|
||||
}`}, 0}, {[]string{`
|
||||
}`}, 0, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import "math/rand"
|
||||
func main() {
|
||||
bad := rand.Int()
|
||||
println(bad)
|
||||
}`}, 1}, {[]string{`
|
||||
}`}, 1, gosec.NewConfig()}, {[]string{`
|
||||
package main
|
||||
import (
|
||||
"crypto/rand"
|
||||
|
|
@ -1065,7 +1068,7 @@ func main() {
|
|||
println(good)
|
||||
i := mrand.Int31()
|
||||
println(i)
|
||||
}`}, 0}}
|
||||
}`}, 0, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG501 - Blacklisted import MD5
|
||||
SampleCodeG501 = []CodeSample{
|
||||
|
|
@ -1080,7 +1083,7 @@ func main() {
|
|||
for _, arg := range os.Args {
|
||||
fmt.Printf("%x - %s\n", md5.Sum([]byte(arg)), arg)
|
||||
}
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG502 - Blacklisted import DES
|
||||
SampleCodeG502 = []CodeSample{
|
||||
|
|
@ -1108,7 +1111,7 @@ func main() {
|
|||
stream := cipher.NewCFBEncrypter(block, iv)
|
||||
stream.XORKeyStream(ciphertext[des.BlockSize:], plaintext)
|
||||
fmt.Println("Secret message is: %s", hex.EncodeToString(ciphertext))
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG503 - Blacklisted import RC4
|
||||
SampleCodeG503 = []CodeSample{{[]string{`
|
||||
|
|
@ -1127,7 +1130,7 @@ func main() {
|
|||
ciphertext := make([]byte, len(plaintext))
|
||||
cipher.XORKeyStream(ciphertext, plaintext)
|
||||
fmt.Println("Secret message is: %s", hex.EncodeToString(ciphertext))
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
|
||||
// SampleCodeG504 - Blacklisted import CGI
|
||||
SampleCodeG504 = []CodeSample{{[]string{`
|
||||
|
|
@ -1138,7 +1141,7 @@ import (
|
|||
)
|
||||
func main() {
|
||||
cgi.Serve(http.FileServer(http.Dir("/usr/share/doc")))
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
// SampleCodeG505 - Blacklisted import SHA1
|
||||
SampleCodeG505 = []CodeSample{
|
||||
{[]string{`
|
||||
|
|
@ -1152,7 +1155,7 @@ func main() {
|
|||
for _, arg := range os.Args {
|
||||
fmt.Printf("%x - %s\n", sha1.Sum([]byte(arg)), arg)
|
||||
}
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
// SampleCode601 - Go build tags
|
||||
SampleCode601 = []CodeSample{{[]string{`
|
||||
// +build tag
|
||||
|
|
@ -1160,5 +1163,5 @@ func main() {
|
|||
package main
|
||||
func main() {
|
||||
fmt.Println("no package imported error")
|
||||
}`}, 1}}
|
||||
}`}, 1, gosec.NewConfig()}}
|
||||
)
|
||||
|
|
|
|||
Loading…
Reference in a new issue