actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-12-25 03:55:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
725 commits 2 branches 41 tags 20 MiB
Commit graph

725 commits

This branch
This branch
All branches
Author SHA1 Message Date
Ville Skyttä
19bda8d15f
Find more tempdirs 
* Find G303 in string concatenations, with os.TempDir, and in path.Join args

* Find G303 with /usr/tmp, too

/usr/tmp is commonly found e.g. on Solaris.
 2022-01-03 21:58:25 +01:00
Ville Skyttä
827fca9a83
build(fmt): use [ instead of [[ (#751) 
When `/bin/sh` is not a shell having `[[`, `make fmt` fails:

```
FORMATTING
/bin/sh: 1: [[: not found
```
 2022-01-03 20:26:14 +01:00
Cosmin Cojocar
ad5d74d5a1
Update to ginkgo v2 (#753) 2022-01-03 18:11:35 +01:00
Yiwei Ding
72f1145f8a
Fix #743 (#748) 
* Check if nosec tag is in front of a line

* Use \n instead of a whitespace in a test case
 2022-01-03 16:48:42 +01:00
Cosmin Cojocar
63a8e789a1
Handle nil when looking up a file by position into a package (#747) 2021-12-22 17:50:46 +01:00
kaiili
3038a30e3c
Add in the config file settings for exclude and include options 
Co-authored-by: kaiili <kaii@openingsource.org>
 2021-12-20 23:43:50 +01:00
renovate[bot]
bf0dd2fdd3
chore(deps): update golang.org/x/crypto commit hash to e495a2d (#745) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-12-20 23:36:02 +01:00
Yiwei Ding
2d1c1a6df7
Track both #nosec and #nosec rulelist for one violation (#741) 2021-12-20 23:33:01 +01:00
Cosmin Cojocar
e0f354aa0d
Add the sponsors section in the README file (#740) 2021-12-15 20:10:40 +01:00
Ville Skyttä
d23ab2d997
Remove space between // and #nosec in examples and internal use 
Comments intended for machines to read do not have the space by
convention.
 2021-12-15 19:31:14 +01:00
Yiwei Ding
35af340d07
Fix #736 (#738) 2021-12-13 17:45:47 +01:00
renovate[bot]
6c0b34426c
chore(deps): update golang.org/x/crypto commit hash to 4570a08 (#737) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-12-13 17:44:29 +01:00
Yiwei Ding
b45f95f6ad
Add support for suppressing the findings 2021-12-09 11:53:36 +01:00
renovate[bot]
040327f7d7
chore(deps): update all dependencies (#734) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-12-07 15:49:48 +01:00
Lars
6a41fb9e61
Fix https://github.com/securego/gosec/issues/714 (#733) 2021-11-24 16:34:42 +01:00
renovate[bot]
c95e9c21e7
chore(deps): update all dependencies (#731) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-11-22 14:04:48 +01:00
Cosmin Cojocar
e57efa8482
Fix a panic in suproc rule when the declaration of the variable is not available in the AST (#728) 2021-11-16 21:41:26 +01:00
Marc Brugger
ff17c30a97
Use go embed for templates (#725) 2021-11-15 16:17:22 +01:00
Matthew Jaffee
3eba7b8a3e
add openssh to docker image (#719) 
I'm trying to scan a project which has dependencies which are private projects. When Go tries to fetch the dependencies it normally uses HTTPS, but that doesn't work if they're private (terminal prompts disabled, can't enter username/password). So you do this little trick with git configuration to get Go to fetch dependencies over ssh: `GIT_CONFIG_PARAMETERS=url.ssh://git@github.com/.insteadOf=https://github.com/`
unfortunately the docker image doesn't have ssh installed so this doesn't work :)
 2021-11-10 21:13:20 +01:00
Cosmin Cojocar
55c6ceaaa6
Fix crash when parsing the TLS min version value (#724) 2021-11-09 21:59:53 +01:00
Ville Skyttä
40fa36d1de
G303: catch with os.WriteFile, add os.Create test case (#718) 
* Add G303 os.Create test case

* Catch G303 with os.WriteFile too
 2021-11-09 21:13:45 +01:00
renovate[bot]
873ac243ea
chore(deps): update all dependencies (#722) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-11-09 21:05:07 +01:00
Ville Skyttä
f1f0056a90
Spelling fixes (#717) 2021-11-09 21:02:24 +01:00
renovate[bot]
0680c75f99
chore(deps): update all dependencies (#716) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-11-01 20:56:57 +01:00
Ryan Leung
79c8b79263
use a better naming for the variable (#715) 
Signed-off-by: Ryan Leung <rleungx@gmail.com>
 2021-10-19 11:54:51 +02:00
Cosmin Cojocar
69213955da
Fix the SBOM generation step in the release action (#712) 2021-10-15 10:57:09 +02:00
Cosmin Cojocar
5a3a27afae
Phase out support for go version 1.15 because current ginko is not backward compatible (#710) 
We are going to support only the stable versions provided by the Go team.
 2021-10-15 10:46:13 +02:00
Cam
17105ab93e
spelling fix (#708) 2021-10-14 09:54:32 +02:00
xq840622
1297bedbc7
Update README.md (#707) 
"io/ioutil" package name is "ioutil"
 2021-10-14 09:54:09 +02:00
Eng Zer Jun
7fd4aef9dc
feat: add os.ReadFile to G304 (#706) 
In Go 1.16 or higher, the `io/ioutil` has been deprecated and the
`ioutil.ReadFile` function now calls `os.ReadFile`.

Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
 2021-10-14 09:53:26 +02:00
nobishii
991dd94f3a
Update local installation instruction (#703) 
Update local installation instruction for Go1.16+.
 2021-10-05 19:33:55 +02:00
Yuval Kashtan
1933cba5b5
Add os.Unsetenv to NoErrorCheck whitelist (#702) 
it always return nil err
 2021-10-05 19:30:34 +02:00
renovate[bot]
e73248cc12
chore(deps): update all dependencies (#701) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-10-05 19:29:19 +02:00
Matthieu MOREL
c59cd6bb95
Update renovate.json (#699) 2021-09-19 23:24:39 +02:00
Matthieu MOREL
bfb0f422fe
chore(lint): enable errorlint and gci (#698) 2021-09-13 09:40:10 +02:00
renovate[bot]
cb89567f99
chore(deps): update module github.com/lib/pq to v1.10.3 (#695) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-09-13 09:39:36 +02:00
Cosmin Cojocar
1b2eecc8c4
Enable go 1.17 in the build and release workflows (#694) 
Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>
 2021-09-02 14:59:49 +02:00
Nanik
efbefc6930
fix: create a separate type for flag that has validation (#692) 2021-09-02 14:44:20 +02:00
renovate[bot]
1978a52ff4
Update all dependencies (#690) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-08-23 08:04:46 +02:00
Marc Brugger
fd5472caaf
remove tabs (#689) 2021-08-20 10:27:45 +02:00
Cosmin Cojocar
d3309fb4f5
Add a more generic message for rule g204 (#688) 2021-08-19 15:18:20 +02:00
Marc Brugger
b695b66e4d
add key to Highlight component (#686) 2021-08-19 14:54:12 +02:00
Marc Brugger
aee782bfe8
add summary to html report (#687) 2021-08-19 14:53:39 +02:00
Cosmin Cojocar
f285d612b5
Fix formatting issues with gofumpt (#685) 
Signed-off-by: Cosmin Cojocar <ccojocar@cloudbees.com>
 2021-08-18 13:16:21 +02:00
Marc Brugger
ba23b5e49a
Add possibility to list waived (nosec) marked issues but not count them as such 2021-08-18 13:00:38 +02:00
Nanik
5a131be2ec
fix: add more rules for G204 (#677) 
* fix: add more rules for G204

* fix: add extra test and comment
 2021-08-16 11:31:51 +02:00
Rodrigo Broggi
9f30bb6602
Typo correction (#681) 
Correcting the command flag from 'tag' to 'tags'
 2021-08-16 11:29:35 +02:00
renovate[bot]
83355dc837
Update all dependencies (#683) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-08-16 11:28:27 +02:00
renovate[bot]
2d4133d7a1
Update module github.com/onsi/gomega to v1.15.0 (#679) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-08-09 17:29:21 +02:00
Phil Calçado
91447a45f5
Add SeatGeek to USERS.md (#678) 
We just added gosec to our standard Golang tooling and pipelines.
 2021-08-09 17:28:31 +02:00