gosec

gosec copied to clipboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/securego/gosec). ## Awaiting Schedule The following updates are...

renovate[bot]

G304 on `os.Executable`

1

### Summary **G304** is raised when we try to read the output of `os.Executable()` ### Steps to reproduce the behavior ```go package main import ( "fmt" "io/ioutil" "os" "path/filepath" )...

asiffer

Rewrite to leverage the go analysis package

4

We should consider adopting a more standard framework for the gosec internals. https://go.googlesource.com/tools/+/master/go/analysis/doc.go

gcmurphy

Use multiple output formats

8

### Summary I want multiple output formats to be generated + stdout format while running the gosec. ### Steps to reproduce the behavior `GO111MODULE=on ./bin/gosec -fmt=text -out=text.txt -fmt=json -out=result.json ./...`...

ShreyasSubhedar

Write a package for data flow analysis

7

### Summary Write a package which implements various primitives for data flow analysis. This package can be used by the rules to perform taint analysis, or other security checks. [godoctor/analysis](https://github.com/godoctor/godoctor/tree/master/analysis)...

ccojocar

Detect panics within code base

5

Could be useful when auditing a code base to know about cases which call into panic without a recover clause.

gcmurphy

v2.9.6 ignores all nosec annotations

4

### Summary The latest version of gosec seems to ignore all nosec annotations for rule G201. Reverting to v2.9.5 fixed my issue though, so something's borked with v2.9.6 I imagine?...

tim-lo

gosec G101 false positive

1

### Summary gosec throws a false positive when using sql functions with placeholders Offending line: ```golang e_USER_PASSWD := `UPDATE users set password=sha2(?, 256) where id=?` ``` ### Steps to reproduce...

mrvik

Add a rule to check if Content-Type is not explicitly set using Header().Set()

1

### Summary As described by CVE-2020-24553 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24553) , there's a possibility of the default content-type being set to text/html CGI/FCGI handlers. It would be helpful to have a rule which...

sanAnand

Add rules for regular expressions (regexp)

2

### Summary Add some rules for regular expressions like: https://github.com/attackercan/regexp-security-cheatsheet Especially ^$ can introduce some security issues when validating data

dcu