actions/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2024-12-30 14:35:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
1101 commits 3 branches 41 tags 20 MiB
Commit graph

1101 commits

This branch
This branch
All branches
Author SHA1 Message Date
robot-5
afc9903ba9
Fix use rule IDs to retrieve the rule config 2022-03-28 20:28:02 +02:00
renovate[bot]
82eaa12696
chore(deps): update all dependencies (#796) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-03-28 20:23:59 +02:00
Cosmin Cojocar
607d607b51
Enable Go 1.18 in the ci and release workflows 
* Enable Go 1.18 in the ci and release workflows

* Fix lint warning

* Add golangci as a make target
 2022-03-21 16:53:22 +01:00
Cosmin Cojocar
b99b5f7838
Fix the lint action after upgrade (#790) 2022-03-14 14:19:29 +01:00
renovate[bot]
8af0af7611
chore(deps): update all dependencies (#789) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-03-14 14:10:28 +01:00
Per Arn
ea5d31f7f5
Add a recursive flag -r to skip specifying ./... path 
* added recursive flag to skip specifying ./... path

* refactored to remove code duplication
 2022-03-07 10:31:22 +01:00
Calin Capitanu
48bbf96b56
Adds directory traversal for Http.Dir("/") 2022-03-06 10:58:47 +01:00
Cosmin Cojocar
26f10e0a7a
Extend the release action to sign the docker image and binary files with cosign (#781) 
* Extend the release action to sign the docker image and binary files with cosign

* Fix lint warnings

* Fix the ling warnings

* Fix the lint warnings
 2022-02-22 21:33:42 +01:00
kruskal
7d539ed494
feat: add concurrency option to parallelize package loading (#778) 
* feat: add concurrency option to parallelize package loading

* refactor: move wg.add inside the for loop

* fix: gracefully stop the workers on error

* test: add test for concurrent scan
 2022-02-16 18:23:37 +01:00
Renovate Bot
43577cebb7 chore(deps): update all dependencies 2022-02-16 12:21:25 +01:00
Cosmin Cojocar
c0680bb6a3 Process the code snippet before adding it to the SARIF report 
Preprocess the code snippet from the issue in order to extract only the line(s)
of code where the issue is located.  In addition remove the line numbers and whitespaces
before writing the code snippet into the SARIF report.
 2022-02-09 16:19:40 +01:00
de-jcup
db8d98b571 Updated sponsor link in README.md 
- Because of rebranding (Daimler AG has become
  Mercedes-Benz Group AG) the github organization has
  been renamed as well.
- Updated sponsorship link in README.md to new github organization
 2022-02-07 10:34:42 +01:00
Renovate Bot
507f8472ca chore(deps): update golang.org/x/crypto commit hash to 30dcbda 2022-02-07 10:34:16 +01:00
Renovate Bot
853e1d5034 chore(deps): update all dependencies 2022-01-31 18:58:38 +01:00
Cosmin Cojocar
09a2941ad4 Use the CWE name as a name in the SARIF report 2022-01-27 15:51:51 +01:00
renovate[bot]
9399e7bed7
chore(deps): update all dependencies (#771) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-01-27 11:26:33 +10:00
Cosmin Cojocar
2fad8a4193 Resolve the TLS min version when is declarted in the same package but in a different file 2022-01-26 19:27:26 +01:00
Cosmin Cojocar
1fbcf10e18 Add a test for tls min version defined in a different file 2022-01-26 19:27:26 +01:00
renovate[bot]
b12c0f6e4e
chore(deps): update all dependencies (#765) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-01-26 11:10:11 +01:00
kaiili
1d909e2687
Add db.Exec and db.Prepare to the sql rule (#763) 
* Add db.Exec and db.Prepare to the sql rule

* add test cases for G201,G202
 2022-01-17 13:50:37 +01:00
renovate[bot]
742aa848f9
chore(deps): update golang.org/x/crypto commit hash to 5e0467b (#764) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-01-17 12:42:54 +01:00
Cosmin Cojocar
7be6d4efb5
Add os.Create to the readfile rule (#761) 2022-01-12 19:33:17 +01:00
kaiili
75cc7dcd51
Fix false negative for SQL injection when using DB.QueryRow.Scan() (#759) 2022-01-12 16:33:39 +01:00
renovate[bot]
58058af0c8
chore(deps): update dependency highlight.js to v11.4.0 (#758) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-01-10 10:56:36 +01:00
kaiili
9d66b0d346
Fix false negatives for SQL injection in multi-line queries 2022-01-05 12:05:53 +01:00
Ville Skyttä
4c1afaa492
Find G303 with filepath.Join'd temp dirs (#754) 2022-01-04 14:48:02 +01:00
Ville Skyttä
19bda8d15f
Find more tempdirs 
* Find G303 in string concatenations, with os.TempDir, and in path.Join args

* Find G303 with /usr/tmp, too

/usr/tmp is commonly found e.g. on Solaris.
 2022-01-03 21:58:25 +01:00
Ville Skyttä
827fca9a83
build(fmt): use [ instead of [[ (#751) 
When `/bin/sh` is not a shell having `[[`, `make fmt` fails:

```
FORMATTING
/bin/sh: 1: [[: not found
```
 2022-01-03 20:26:14 +01:00
Cosmin Cojocar
ad5d74d5a1
Update to ginkgo v2 (#753) 2022-01-03 18:11:35 +01:00
Yiwei Ding
72f1145f8a
Fix #743 (#748) 
* Check if nosec tag is in front of a line

* Use \n instead of a whitespace in a test case
 2022-01-03 16:48:42 +01:00
Cosmin Cojocar
63a8e789a1
Handle nil when looking up a file by position into a package (#747) 2021-12-22 17:50:46 +01:00
kaiili
3038a30e3c
Add in the config file settings for exclude and include options 
Co-authored-by: kaiili <kaii@openingsource.org>
 2021-12-20 23:43:50 +01:00
renovate[bot]
bf0dd2fdd3
chore(deps): update golang.org/x/crypto commit hash to e495a2d (#745) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-12-20 23:36:02 +01:00
Yiwei Ding
2d1c1a6df7
Track both #nosec and #nosec rulelist for one violation (#741) 2021-12-20 23:33:01 +01:00
Cosmin Cojocar
e0f354aa0d
Add the sponsors section in the README file (#740) 2021-12-15 20:10:40 +01:00
Ville Skyttä
d23ab2d997
Remove space between // and #nosec in examples and internal use 
Comments intended for machines to read do not have the space by
convention.
 2021-12-15 19:31:14 +01:00
Yiwei Ding
35af340d07
Fix #736 (#738) 2021-12-13 17:45:47 +01:00
renovate[bot]
6c0b34426c
chore(deps): update golang.org/x/crypto commit hash to 4570a08 (#737) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-12-13 17:44:29 +01:00
Yiwei Ding
b45f95f6ad
Add support for suppressing the findings 2021-12-09 11:53:36 +01:00
renovate[bot]
040327f7d7
chore(deps): update all dependencies (#734) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-12-07 15:49:48 +01:00
Lars
6a41fb9e61
Fix https://github.com/securego/gosec/issues/714 (#733) 2021-11-24 16:34:42 +01:00
renovate[bot]
c95e9c21e7
chore(deps): update all dependencies (#731) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-11-22 14:04:48 +01:00
Cosmin Cojocar
e57efa8482
Fix a panic in suproc rule when the declaration of the variable is not available in the AST (#728) 2021-11-16 21:41:26 +01:00
Marc Brugger
ff17c30a97
Use go embed for templates (#725) 2021-11-15 16:17:22 +01:00
Matthew Jaffee
3eba7b8a3e
add openssh to docker image (#719) 
I'm trying to scan a project which has dependencies which are private projects. When Go tries to fetch the dependencies it normally uses HTTPS, but that doesn't work if they're private (terminal prompts disabled, can't enter username/password). So you do this little trick with git configuration to get Go to fetch dependencies over ssh: `GIT_CONFIG_PARAMETERS=url.ssh://git@github.com/.insteadOf=https://github.com/`
unfortunately the docker image doesn't have ssh installed so this doesn't work :)
 2021-11-10 21:13:20 +01:00
Cosmin Cojocar
55c6ceaaa6
Fix crash when parsing the TLS min version value (#724) 2021-11-09 21:59:53 +01:00
Ville Skyttä
40fa36d1de
G303: catch with os.WriteFile, add os.Create test case (#718) 
* Add G303 os.Create test case

* Catch G303 with os.WriteFile too
 2021-11-09 21:13:45 +01:00
renovate[bot]
873ac243ea
chore(deps): update all dependencies (#722) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-11-09 21:05:07 +01:00
Ville Skyttä
f1f0056a90
Spelling fixes (#717) 2021-11-09 21:02:24 +01:00
renovate[bot]
0680c75f99
chore(deps): update all dependencies (#716) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-11-01 20:56:57 +01:00