Comments (6)
Well it really depends on the use case. For example 0644 would not be acceptable if the file contained any sort of credentials. So we have opted for a strict but secure default. FWIW - This is configurable (but not currently documented feature).
github.com/GoAstScanner/gas master ✗ 28d ◒ ⍉
▶ ./gas -include=G302 ~/samples/fileperms1_sample.go
Results:
[/Users/gm/samples/fileperms1_sample.go:6] - Expect file permissions to be 0600 or less (Confidence: HIGH, Severity: MEDIUM)
> os.Chmod("/tmp/somefile", 0777)
[/Users/gm/samples/fileperms1_sample.go:7] - Expect file permissions to be 0600 or less (Confidence: HIGH, Severity: MEDIUM)
> os.Chmod("/tmp/someotherfile", 0644)
Summary:
Files: 1
Lines: 8
Nosec: 0
Issues: 2
github.com/GoAstScanner/gas master ✗ 28d ◒ ⍉
▶ cat config.json
{
"G302": "0644"
}
github.com/GoAstScanner/gas master ✗ 28d ◒
▶ ./gas -conf=config.json -include=G302 ~/samples/fileperms1_sample.go
Results:
[/Users/gm/samples/fileperms1_sample.go:6] - Expect file permissions to be 0644 or less (Confidence: HIGH, Severity: MEDIUM)
> os.Chmod("/tmp/somefile", 0777)
Summary:
Files: 1
Lines: 8
Nosec: 0
Issues: 1
from gosec.
The aim of gosec is to find potential security problems and you could make a similar argument against most of the rules in gosec really as usually there isn't enough context to make a definitive decision. From a security researchers perspective knowing places like this in a code base you may be unfamiliar with is really useful.
For this specific scenario if you are working closely with the tool you have a multitude of options:
- Disable the rule completely
- Alter the permission level you warn about
- Add an annotations to any false positives to avoid future warnings.
from gosec.
from gosec.
Sorry. Just to be clear this rule will trigger wherever Go source code is creating a file not on the actual permissions of Go source files within a project.
From a security review / code auditing point of view I want to know where files are being created on the filesystems that aren't following principle of least privilege type practices.
from gosec.
Oh, I misunderstood. Strange, the file it complained about doesn't write any files directly.
...And of course now it won't repro. Closing. Thanks. :)
from gosec.
Hi @gcmurphy,
The principle of least privilege type practices does not justify the error in the lint. The lint cannot know if I am giving or not the least privilege for my use case.
Example:
I am tooling a process where it would create a file that should/can be edit for anyone.
The linter is raising issues when should not and trying to do a check that goes beyond its responsibility since it is unable to analyse the scenario and the business rules to know if the 644 is or nor the least privilege that should be applied, indeed.
from gosec.
Related Issues (20)
- Add detection of overflow during integer conversion HOT 1
- Regarding customizing a configuration file to load G101 rules, where keywords with "-" cannot be matched HOT 1
- Documentation on how to use sig files for release binaries HOT 1
- 'go install' doesn't work HOT 2
- Gosec Configuration file to integrate with GitHub ( as a workflow file) HOT 2
- Add an option to set the Go version HOT 4
- criteria for adding new secret patterns versus relying on high entropy detection HOT 1
- Setting the Gosec Confidence level to Medium. HOT 1
- New release for the github action of gosec to include #1153 HOT 1
- possible regression on first g104 sample HOT 1
- Rule G401 covers multiple different CWEs.
- Create a taint analysis engine HOT 2
- Add rules for deprecated hashing algorithms
- Go version issues when running in CI (Github Actions) HOT 4
- can we get a patch release out to support go 1.22 fixes? HOT 2
- Gosec does not detect G204 if user input is from a function parameter
- CheckAnalyzers doesn't seem to respect exclude or nosec (e.g. G602) HOT 2
- GoSec pulling the image before docker hub login HOT 1
- G115: integer overflow conversion uint8 -> int64 HOT 21
- G115 ignores bounds checks HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gosec.