README
¶
gosec -Golang Security Checker
Inspects source code for security problems by scanning the Go AST.
License
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License here.
Project status
Install
$ go get github.com/securego/gosec/cmd/gosec/...
Usage
Gosec can be configured to only run a subset of rules, to exclude certain file paths, and produce reports in different formats. By default all rules will be run against the supplied input files. To recursively scan from the current directory you can supply './...' as the input argument.
Selecting rules
By default gosec will run all rules against the supplied file paths. It is however possible to select a subset of rules to run via the '-include=' flag, or to specify a set of rules to explicitly exclude using the '-exclude=' flag.
Available rules
- G101: Look for hardcoded credentials
- G102: Bind to all interfaces
- G103: Audit the use of unsafe block
- G104: Audit errors not checked
- G105: Audit the use of math/big.Int.Exp
- G106: Audit the use of ssh.InsecureIgnoreHostKey
- G201: SQL query construction using format string
- G202: SQL query construction using string concatenation
- G203: Use of unescaped data in HTML templates
- G204: Audit use of command execution
- G301: Poor file permissions used when creating a directory
- G302: Poor file permisions used with chmod
- G303: Creating tempfile using a predictable path
- G304: File path provided as taint input
- G305: File traversal when extracting zip archive
- G401: Detect the usage of DES, RC4, or MD5
- G402: Look for bad TLS connection settings
- G403: Ensure minimum RSA key length of 2048 bits
- G404: Insecure random number source (rand)
- G501: Import blacklist: crypto/md5
- G502: Import blacklist: crypto/des
- G503: Import blacklist: crypto/rc4
- G504: Import blacklist: net/http/cgi
# Run a specific set of rules
$ gosec -include=G101,G203,G401 ./...
# Run everything except for rule G303
$ gosec -exclude=G303 ./...
Excluding files:
gosec will ignore dependencies in your vendor directory any files that are not considered build artifacts by the compiler (so test files).
Annotating code
As with all automated detection tools there will be cases of false positives. In cases where gosec reports a failure that has been manually verified as being safe it is possible to annotate the code with a '#nosec' comment.
The annotation causes gosec to stop processing any further nodes within the AST so can apply to a whole block or more granularly to a single expression.
import "md5" // #nosec
func main(){
/* #nosec */
if x > y {
h := md5.New() // this will also be ignored
}
}
In some cases you may also want to revisit places where #nosec annotations have been used. To run the scanner and ignore any #nosec annotations you can do the following:
$ gosec -nosec=true ./...
Build tags
gosec is able to pass your Go build tags to the analyzer. They can be provided as a comma separated list as follows:
$ gosec -tag debug,ignore ./...
Output formats
gosec currently supports text, json, yaml, csv and JUnit XML output formats. By default results will be reported to stdout, but can also be written to an output file. The output format is controlled by the '-fmt' flag, and the output file is controlled by the '-out' flag as follows:
# Write output in json format to results.json
$ gosec -fmt=json -out=results.json *.go
Development
Prerequisites
Install dep according to the instructions here: https://github.com/golang/dep Install the latest version of golint: https://github.com/golang/lint
Build
make
Tests
make test
Release Build
gosec can be released as follows:
make release VERSION=2.0.0
The released version of the tool is available in the build folder. The build information should be displayed in the usage text.
./build/gosec-2.0.0-linux-amd64 -h
gosec - Golang security checker
gosec analyzes Go source code to look for common programming mistakes that
can lead to security problems.
VERSION: 2.0.0
GIT TAG: 96489ff
BUILD DATE: 2018-02-21
Docker image
You can execute a release and build the docker image as follows:
make image VERSION=2.0.0
Now you can run the gosec tool in a container against your local workspace:
docker run -it -v <YOUR LOCAL WORKSPACE>:/workspace gosec /workspace
Generate TLS rule
The configuration of TLS rule can be generated from Mozilla's TLS ciphers recommendation.
First you need to install the generator tool:
go get github.com/securego/gosec/cmd/tlsconfig/...
You can invoke now the go generate in the root of the project:
go generate ./...
This will generate the rules/tls_config.go file with will contain the current ciphers recommendation from Mozilla.
Documentation
¶
Overview ¶
Package gosec holds the central scanning logic used by gosec security scanner
Index ¶
- Constants
- func GetCallInfo(n ast.Node, ctx *Context) (string, string, error)
- func GetCallObject(n ast.Node, ctx *Context) (*ast.CallExpr, types.Object)
- func GetChar(n ast.Node) (byte, error)
- func GetFloat(n ast.Node) (float64, error)
- func GetImportPath(name string, ctx *Context) (string, bool)
- func GetImportedName(path string, ctx *Context) (string, bool)
- func GetInt(n ast.Node) (int64, error)
- func GetLocation(n ast.Node, ctx *Context) (string, int)
- func GetString(n ast.Node) (string, error)
- func MatchCallByPackage(n ast.Node, c *Context, pkg string, names ...string) (*ast.CallExpr, bool)
- func MatchCallByType(n ast.Node, ctx *Context, requiredType string, calls ...string) (*ast.CallExpr, bool)
- func MatchCompLit(n ast.Node, ctx *Context, required string) *ast.CompositeLit
- func TryResolve(n ast.Node, c *Context) bool
- type Analyzer
- type CallList
- type Config
- func (c Config) Get(section string) (interface{}, error)
- func (c Config) GetGlobal(option string) (string, error)
- func (c Config) ReadFrom(r io.Reader) (int64, error)
- func (c Config) Set(section string, value interface{})
- func (c Config) SetGlobal(option, value string)
- func (c Config) WriteTo(w io.Writer) (int64, error)
- type Context
- type ImportTracker
- type Issue
- type MetaData
- type Metrics
- type Rule
- type RuleBuilder
- type RuleSet
- type Score
Constants ¶
const ( // Globals are applicable to all rules and used for general // configuration settings for gosec. Globals = "global" )
Variables ¶
This section is empty.
Functions ¶
func GetCallInfo ¶
GetCallInfo returns the package or type and name associated with a call expression.
func GetCallObject ¶
GetCallObject returns the object and call expression and associated object for a given AST node. nil, nil will be returned if the object cannot be resolved.
func GetImportPath ¶
GetImportPath resolves the full import path of an identifer based on the imports in the current context.
func GetImportedName ¶
GetImportedName returns the name used for the package within the code. It will resolve aliases and ignores initalization only imports.
func GetLocation ¶
GetLocation returns the filename and line number of an ast.Node
func MatchCallByPackage ¶
MatchCallByPackage ensures that the specified package is imported, adjusts the name for any aliases and ignores cases that are initialization only imports.
Usage:
node, matched := MatchCallByPackage(n, ctx, "math/rand", "Read")
func MatchCallByType ¶
func MatchCallByType(n ast.Node, ctx *Context, requiredType string, calls ...string) (*ast.CallExpr, bool)
MatchCallByType ensures that the node is a call expression to a specific object type.
Usage:
node, matched := MatchCallByType(n, ctx, "bytes.Buffer", "WriteTo", "Write")
func MatchCompLit ¶
MatchCompLit will match an ast.CompositeLit based on the supplied type
Types ¶
type Analyzer ¶
type Analyzer struct {
// contains filtered or unexported fields
}
Analyzer object is the main object of gosec. It has methods traverse an AST and invoke the correct checking rules as on each node as required.
func NewAnalyzer ¶
NewAnalyzer builds a new anaylzer.
func (*Analyzer) LoadRules ¶
func (gosec *Analyzer) LoadRules(ruleDefinitions map[string]RuleBuilder)
LoadRules instantiates all the rules to be used when analyzing source packages
func (*Analyzer) Report ¶
Report returns the current issues discovered and the metrics about the scan
type CallList ¶
type CallList map[string]set
CallList is used to check for usage of specific packages and functions.
type Config ¶
type Config map[string]interface{}
Config is used to provide configuration and customization to each of the rules.
func NewConfig ¶
func NewConfig() Config
NewConfig initializes a new configuration instance. The configuration data then needs to be loaded via c.ReadFrom(strings.NewReader("config data")) or from a *os.File.
func (Config) ReadFrom ¶
ReadFrom implements the io.ReaderFrom interface. This should be used with io.Reader to load configuration from file or from string etc.
type Context ¶
type Context struct {
FileSet *token.FileSet
Comments ast.CommentMap
Info *types.Info
Pkg *types.Package
Root *ast.File
Config map[string]interface{}
Imports *ImportTracker
Ignores []map[string]bool
}
The Context is populated with data parsed from the source code as it is scanned. It is passed through to all rule functions as they are called. Rules may use this data in conjunction withe the encoutered AST node.
type ImportTracker ¶
type ImportTracker struct {
Imported map[string]string
Aliased map[string]string
InitOnly map[string]bool
}
ImportTracker is used to normalize the packages that have been imported by a source file. It is able to differentiate between plain imports, aliased imports and init only imports.
func NewImportTracker ¶
func NewImportTracker() *ImportTracker
NewImportTracker creates an empty Import tracker instance
func (*ImportTracker) TrackImport ¶
func (t *ImportTracker) TrackImport(n ast.Node)
TrackImport tracks imports and handles the 'unsafe' import
func (*ImportTracker) TrackPackages ¶
func (t *ImportTracker) TrackPackages(pkgs ...*types.Package)
TrackPackages tracks all the imports used by the supplied packages
type Issue ¶
type Issue struct {
Severity Score `json:"severity"` // issue severity (how problematic it is)
Confidence Score `json:"confidence"` // issue confidence (how sure we are we found it)
RuleID string `json:"rule_id"` // Human readable explanation
What string `json:"details"` // Human readable explanation
File string `json:"file"` // File name we found it in
Code string `json:"code"` // Impacted code line
Line string `json:"line"` // Line number in file
}
Issue is returnd by a gosec rule if it discovers an issue with the scanned code.
type MetaData ¶
MetaData is embedded in all gosec rules. The Severity, Confidence and What message will be passed tbhrough to reported issues.
type Metrics ¶
type Metrics struct {
NumFiles int `json:"files"`
NumLines int `json:"lines"`
NumNosec int `json:"nosec"`
NumFound int `json:"found"`
}
Metrics used when reporting information about a scanning run.
type RuleBuilder ¶
RuleBuilder is used to register a rule definition with the analyzer
type RuleSet ¶
A RuleSet maps lists of rules to the type of AST node they should be run on. The anaylzer will only invoke rules contained in the list associated with the type of AST node it is currently visiting.
type Score ¶
type Score int
Score type used by severity and confidence values
func (Score) MarshalJSON ¶
MarshalJSON is used convert a Score object into a JSON representation
Source Files
Directories