FilesExpand file tree

main

/

.semgrep.yml

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

93 lines (86 loc) · 2.38 KB

main

/

.semgrep.yml

Copy path

Top

File metadata and controls

• Code
• Blame

93 lines (86 loc) · 2.38 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

rules:

- id: hardcoded-secret-string

patterns:

- pattern-either:

- pattern: |

$KEY = "..."

- pattern: |

$KEY = '...'

- metavariable-regex:

metavariable: $KEY

regex: (?i)(password|passwd|pwd|secret|api_key|apikey|token|auth)

- metavariable-regex:

metavariable: $X

regex: ^(?!.*test|example|dummy|fake|mock).*

message: Potential hardcoded secret found

languages: [go]

severity: ERROR

- id: sql-injection

patterns:

- pattern-either:

- pattern: |

db.Query($QUERY + $INPUT)

- pattern: |

db.Exec($QUERY + $INPUT)

- pattern: |

fmt.Sprintf($QUERY, $INPUT)

message: Potential SQL injection vulnerability

languages: [go]

severity: ERROR

- id: command-injection

patterns:

- pattern-either:

- pattern: |

exec.Command($CMD + $INPUT)

- pattern: |

exec.CommandContext(..., $CMD + $INPUT)

message: Potential command injection vulnerability

languages: [go]

severity: ERROR

- id: insecure-random

patterns:

- pattern: math/rand.$FUNC(...)

- pattern-not-inside: |

func init() {

...

}

message: Use crypto/rand for security-sensitive randomness

languages: [go]

severity: WARNING

- id: unhandled-error

patterns:

- pattern: $X, _ := $FUNC(...)

- pattern-not: $X, _ := fmt.$PRINT(...)

message: Error not handled

languages: [go]

severity: WARNING

- id: path-traversal

patterns:

- pattern-either:

- pattern: filepath.Join($BASE, $INPUT)

- pattern: path.Join($BASE, $INPUT)

- pattern-not: |

filepath.Clean(filepath.Join($BASE, $INPUT))

message: Potential path traversal vulnerability

languages: [go]

severity: ERROR

- id: weak-crypto

patterns:

- pattern-either:

- pattern: md5.New()

- pattern: sha1.New()

- pattern: des.NewCipher(...)

message: Weak cryptographic algorithm

languages: [go]

severity: WARNING

- id: tls-skip-verify

patterns:

- pattern: |

&tls.Config{

...,

InsecureSkipVerify: true,

...

}

message: TLS certificate verification disabled

languages: [go]

severity: ERROR