gosec分析Go原始碼以查詢可能導致安全問題的常見程式設計錯誤。

它通過掃描Go AST檢查原始碼是否存在安全問題。

https://github.com/securego/gosec

gosec v2.4.0

gosec - Golang security checker

gosec analyzes Go source code to look for common programming mistakes that can lead to security problems.

用法:
    # 檢查單個程式包
    $ gosec $GOPATH/src/github.com/example/project

    # 檢查當前目錄下的所有程式包並將結果儲存為JSON格式
    $ gosec 
 
-fmt=json -out=results.json ./...

    # 執行一組特定的規則 (預設情況下將執行所有的規則):
    $ gosec -include=G101,G203,G401 ./...

    # 執行除了提供的之外的所有規則
    $ gosec -exclude=G101 $GOPATH/src/github.com/example/project/...

選項:
    -conf string          可選配置檔案的路徑
    -confidence string    以低於給定值的置信度篩選出問題 有效選項包括: low, medium, high (default "
 
low")
    -exclude string       以逗號分隔的要排除的規則ID列表 請參閱"規則"列表
    -exclude-dir value    從掃描中排除目錄 可以多次指定
    -fmt string           設定輸出格式 有效選項包括: json, yaml, csv, junit-xml, html, sonarqube, golint or text (default "text")
    -include string       以逗號分隔的要包含的規則ID列表 請參閱"規則"列表
    -log string           將訊息記錄到檔案而不是標準錯誤
    
 
-no-fail              即使發現問題也不要使掃描失敗
    -nosec                設定時忽略"#nosec"註釋
    -nosec-tag string     為"#nosec"設定替代字串 一些例子: #dontanalyze, #falsepositive
    -out string           設定結果的輸出檔案
    -quiet                僅在發現錯誤時顯示輸出
    -severity string      篩選出嚴重性低於給定值的問題 有效選項包括: low, medium, high (default "low")
    -sort                 按嚴重性對問題進行排序 (default true)
    -tags string          以逗號分隔的構建標記列表
    -tests                掃描測試檔案
    -version              列印版本並退出 退出程式碼為0

規則:
    G101: Look for hardcoded credentials
    G102: Bind to all interfaces
    G103: Audit the use of unsafe block
    G104: Audit errors not checked
    G106: Audit the use of ssh.InsecureIgnoreHostKey function
    G107: Url provided to HTTP request as taint input
    G108: Profiling endpoint is automatically exposed
    G109: Converting strconv.Atoi result to int32/int16
    G110: Detect io.Copy instead of io.CopyN when decompression
    G201: SQL query construction using format string
    G202: SQL query construction using string concatenation
    G203: Use of unescaped data in HTML templates
    G204: Audit use of command execution
    G301: Poor file permissions used when creating a directory
    G302: Poor file permissions used when creation file or using chmod
    G303: Creating tempfile using a predictable path
    G304: File path provided as taint input
    G305: File path traversal when extracting zip archive
    G306: Poor file permissions used when writing to a file
    G307: Unsafe defer call of a method returning an error
    G401: Detect the usage of DES, RC4, MD5 or SHA1
    G402: Look for bad TLS connection settings
    G403: Ensure minimum RSA key length of 2048 bits
    G404: Insecure random number source (rand)
    G501: Import blocklist: crypto/md5
    G502: Import blocklist: crypto/des
    G503: Import blocklist: crypto/rc4
    G504: Import blocklist: net/http/cgi
    G505: Import blocklist: crypto/sha1
    G601: Implicit memory aliasing in RangeStmt