Commit graph

497 commits

Author SHA1 Message Date
cosmincojocar
4ae8c95b40 Add an option for Go build tags (#201)
* Add an option for Go build tags

* Update README with a section for Go build tags
2018-04-20 09:45:03 +10:00
cosmincojocar
7790709b81 Discard the logs messages if the quite flag is set (#200) 2018-04-16 19:41:40 +10:00
Grant Murphy
830cb81b29
Support package resolution and filepaths (#187)
* Support package resolution and filepaths

This change introduces the logic to resolve packages using gotool
and build packages from filepaths. It assumes that the packages
being scanned are located within the GOPATH.

If the GOPATH environment variable is not set the GOPATH is derived
as $HOME/go.

Relates to #184

* Fix build error

* Address unhandled error

* Fix formatting error

* Handle multiple paths on GOPATH
2018-04-16 15:46:39 +10:00
Geoff Baskwill
b643ac26a4 Add rule ID to text output (#198) 2018-04-16 15:44:54 +10:00
cosmincojocar
c25269ef39 Regenerate the TLS config (#199) 2018-04-16 15:44:11 +10:00
Eric Brown
542d0c0e4f Fix up some mistakes in the README instructions (#195)
This fixes a couple issues found in the README in the development
section:
* There was no information provided on dependencies.  Both go/dep
  and golint are required to run make.
* To run the tests, the command 'make test' not 'make tests' has
  to be used.
2018-03-20 09:21:32 +10:00
cosmincojocar
e809226800 Build improvments (#179)
* Add a semantic version to the usage text

* Add a comment to the version function

* Inject the version, git tag and build date as build variables

* Update README

* Fix lint warnings

* Update README

* Manage dependencies with dep tool instead of godep

* Add a Makefile for common build tasks

* Update the build file to use the make tool

* Update Dockerfile

* Add docker entry point in to make the passing of arguments easy

* Update README

* Add missing tools to the build

* Drop 1.7 support and add 1.10

* Fix Go 1.10 according with the travis guidelines

https://docs.travis-ci.com/user/languages/go/

* Update the tls-observatory package

* Fix lint warnings

* Change the output of the tests to be more verbose

* Check if the are build errors before executing the rule test
2018-03-13 08:57:10 +10:00
jonmcclintock
2115402409 Add the rule ID to issues (#188) 2018-03-12 18:18:44 +10:00
cosmincojocar
a0367559a7 Fix TLS config template (#191)
* Fix TLS config template

* Update the log message for unavailable ciphers
2018-03-12 18:17:32 +10:00
Grant Murphy
7116c4d3a1 fix fmt errors 2018-03-09 15:36:31 +10:00
Grant Murphy
ff2b30ff5d Cleanup test output 2018-03-09 15:28:56 +10:00
Grant Murphy
66aea5cd99 fix gofmt errors 2018-03-09 12:49:01 +10:00
Grant Murphy
15095a8bef Merge branch 'jonmcclintock-nosec-specify-rule' 2018-03-09 11:31:05 +10:00
Grant Murphy
90fe5cb5ab Port readfile rule to include ID and metadata 2018-03-09 11:27:41 +10:00
Grant Murphy
58a48c471c Merge branch 'nosec-specify-rule' of git://github.com/jonmcclintock/gas into jonmcclintock-nosec-specify-rule 2018-03-09 10:54:34 +10:00
andyleap
f3c8d59863 Switch to valuespec instead of gendecl for hardcoded credential rule (#186) 2018-03-09 09:49:49 +10:00
coredefend
e76b258456 New Rule Tainted file (#183)
* Add a tool to generate the TLS configuration form Mozilla's ciphers recommendation (#178)

* Add a tool which generates the TLS rule configuration from Mozilla server side
TLS configuration

* Update README

* Remove trailing space in README

* Update dependencies

* Fix the commends of the generated functions

* Add nil pointer check to rule. (#181)

TypeOf returns the type of expression e, or nil if not found. We are
calling .String() on a value that may be nil in this clause.

Relates to #174

* Add support for YAML output format (#177)

* Add YAML output format

* Update README

* added rule to check for tainted file path

* added #nosec to main/issue.go

* updated test case import
2018-03-09 09:23:27 +10:00
Jon McClintock
429ac07bbd Change the exclude syntax to be a part of #nosec 2018-03-08 19:01:00 +00:00
Jon McClintock
7bb6f004ae Merge branch 'master' of https://github.com/GoASTScanner/gas into nosec-specify-rule 2018-03-08 18:52:11 +00:00
Eric Brown
57dd25a893 Add an issue template to the project (#185)
This patch adds a template for Issues opened against the
gas project. That way, minimum information is present to debug
the problem.

Signed-off-by: Eric Brown <browne@vmware.com>
2018-03-08 12:38:10 +10:00
cosmincojocar
1d9f816ca5 Add support for YAML output format (#177)
* Add YAML output format

* Update README
2018-03-05 22:20:24 +10:00
Jon McClintock
18700c276f Style tweak 2018-03-03 00:04:48 +00:00
Jon McClintock
6b484e734e Run gofmt 2018-03-03 00:03:39 +00:00
Jon McClintock
105edba686 Leftover from merge. 2018-03-02 23:52:39 +00:00
Jon McClintock
48d59d219a Merge branch 'nosec-specify-rule' of github.com:jonmcclintock/gas into nosec-specify-rule 2018-03-02 23:51:11 +00:00
Jon McClintock
1429033aca Add support for #excluding specific rules 2018-03-02 23:44:51 +00:00
Jon McClintock
3713168816 Merge remote-tracking branch 'upstream/master' 2018-03-02 19:10:42 +00:00
Grant Murphy
c6183b4d5c
Add nil pointer check to rule. (#181)
TypeOf returns the type of expression e, or nil if not found. We are
calling .String() on a value that may be nil in this clause.

Relates to #174
2018-02-28 04:29:25 +10:00
cosmincojocar
edb362fc9d Add a tool to generate the TLS configuration form Mozilla's ciphers recommendation (#178)
* Add a tool which generates the TLS rule configuration from Mozilla server side
TLS configuration

* Update README

* Remove trailing space in README

* Update dependencies

* Fix the commends of the generated functions
2018-02-21 15:59:18 +10:00
cosmincojocar
1c58cbd378 Make the folder permissions more permissive to avoid false positives (#175) 2018-02-15 19:53:01 +10:00
Grant Murphy
d48668e9e7
Merge pull request #170 from cosmincojocar/build_more_checks
Update the build file with more checks
2018-02-11 22:30:14 +10:00
Grant Murphy
777b706a2a
Merge pull request #167 from cosmincojocar/sort_by_severity
Sort the issues by severity in descending order
2018-02-11 22:29:45 +10:00
Cosmin Cojocar
7355f0a119 Fix some gas warnings 2018-02-10 20:10:56 +01:00
Cosmin Cojocar
230d286f4e Fix gofmt formatting 2018-02-10 20:04:58 +01:00
Cosmin Cojocar
e385ab872f Update the build file with more checks
Validate the tool from go version 1.7 onward
2018-02-10 19:59:27 +01:00
Cosmin Cojocar
e15c057349 Update the build file to validate gas from go version 1.7 onward 2018-02-10 19:46:39 +01:00
Cosmin Cojocar
84bfbbfd8c Switch to sort Interface to be backward compatible with older go versions 2018-02-10 19:45:04 +01:00
Cosmin Cojocar
d4ebb032a9 Sort the issues by severity in descending order before creating the report 2018-02-08 12:12:22 +01:00
Grant Murphy
6b28d5c0e6
Merge pull request #166 from cosmincojocar/fprint_whitelist
Add Fprint, Fprintf, Fprintln to NoErrorCheck whitelist
2018-02-08 11:54:44 +10:00
Grant Murphy
ac4622d395
Merge pull request #165 from cosmincojocar/fix_gas_warnings
Fix some gas warnings
2018-02-08 11:54:16 +10:00
Grant Murphy
a72a21bb2c
Merge pull request #164 from cosmincojocar/ssh_rule
Add a rule to audit the usage of ssh.InsecureIgnoreHostKey
2018-02-08 11:52:42 +10:00
Cosmin Cojocar
6cd7a6d7fe Add Fprint, Fprintf, Fprintln to NoErrorCheck whitelist 2018-02-07 14:13:17 +01:00
Cosmin Cojocar
c2c21553a3 Fix some gas warnings 2018-02-07 14:07:24 +01:00
Cosmin Cojocar
a7cdd9cd8d Add ssh package to the build
The ssh package is not part of the standard library in go 1.5.
2018-02-07 10:10:34 +01:00
Cosmin Cojocar
179c178924 Add some review fixes 2018-02-07 09:23:52 +01:00
Cosmin Cojocar
f1b903f060 Update README 2018-02-06 16:59:00 +01:00
Cosmin Cojocar
d3c3cd6419 Add a rule to detect the usage of ssh InsecureIgnoreHostKey function 2018-02-06 16:56:26 +01:00
Grant Murphy
8b87505d97
Merge pull request #163 from wongherlung/fix-junit-failure-text
Escape html string for JUnit output
2018-02-02 16:07:21 +10:00
Delon Wong Her Laang
33fff9514f Excape html string for junit output. 2018-02-01 12:30:47 +08:00
Grant Murphy
e92170b49a
Merge pull request #160 from wongherlung/junit-xml-output
JUnit XML output
2018-01-30 12:12:30 +10:00