CI Sec check #817

avelino · 2023-05-06T14:44:31Z

avelino
May 6, 2023
Maintainer

Inspects source code for security problems by scanning the Go AST.

We need to worry a bit more about the security of prestd, I can't tell if we look at this issue as we should.

vmesel · 2023-05-07T21:33:20Z

vmesel
May 7, 2023
Collaborator

This is the gosec output for our current main branch:

gosec ./...
[gosec] 2023/05/07 18:30:40 Including rules: default
[gosec] 2023/05/07 18:30:40 Excluding rules: default
[gosec] 2023/05/07 18:30:40 Import directory: /Users/vmesel/Github/prest
[gosec] 2023/05/07 18:30:40 Import directory: /Users/vmesel/Github/prest/adapters/postgres/statements
[gosec] 2023/05/07 18:30:40 Import directory: /Users/vmesel/Github/prest/dbtime
[gosec] 2023/05/07 18:30:40 Import directory: /Users/vmesel/Github/prest/controllers/auth
[gosec] 2023/05/07 18:30:40 Import directory: /Users/vmesel/Github/prest/cmd
[gosec] 2023/05/07 18:30:40 Import directory: /Users/vmesel/Github/prest/testutils
[gosec] 2023/05/07 18:30:40 Import directory: /Users/vmesel/Github/prest/template
[gosec] 2023/05/07 18:30:40 Import directory: /Users/vmesel/Github/prest/config
[gosec] 2023/05/07 18:30:42 Checking package: dbtime
[gosec] 2023/05/07 18:30:42 Checking file: /Users/vmesel/Github/prest/dbtime/dbtime.go
[gosec] 2023/05/07 18:30:42 Import directory: /Users/vmesel/Github/prest/adapters/scanner
[gosec] 2023/05/07 18:30:42 Checking package: main
[gosec] 2023/05/07 18:30:42 Checking file: /Users/vmesel/Github/prest/doc.go
[gosec] 2023/05/07 18:30:42 Import directory: /Users/vmesel/Github/prest/cache
[gosec] 2023/05/07 18:30:42 Checking package: statements
[gosec] 2023/05/07 18:30:42 Checking file: /Users/vmesel/Github/prest/adapters/postgres/statements/queries.go
[gosec] 2023/05/07 18:30:42 Import directory: /Users/vmesel/Github/prest/cmd/prestd
[gosec] 2023/05/07 18:30:43 Import directory: /Users/vmesel/Github/prest/plugins
[gosec] 2023/05/07 18:30:43 Checking package: template
[gosec] 2023/05/07 18:30:43 Checking file: /Users/vmesel/Github/prest/template/funcregistry.go
[gosec] 2023/05/07 18:30:43 Import directory: /Users/vmesel/Github/prest/router
[gosec] 2023/05/07 18:30:43 Checking package: testutils
[gosec] 2023/05/07 18:30:43 Checking file: /Users/vmesel/Github/prest/testutils/testutils.go
[gosec] 2023/05/07 18:30:44 Checking package: scanner
[gosec] 2023/05/07 18:30:44 Checking file: /Users/vmesel/Github/prest/adapters/scanner/scanner.go
[gosec] 2023/05/07 18:30:44 Import directory: /Users/vmesel/Github/prest/context
[gosec] 2023/05/07 18:30:45 Checking package: context
[gosec] 2023/05/07 18:30:45 Checking file: /Users/vmesel/Github/prest/context/keys.go
[gosec] 2023/05/07 18:30:45 Import directory: /Users/vmesel/Github/prest/helpers
[gosec] 2023/05/07 18:30:46 Checking package: auth
[gosec] 2023/05/07 18:30:46 Checking file: /Users/vmesel/Github/prest/controllers/auth/models.go
[gosec] 2023/05/07 18:30:46 Import directory: /Users/vmesel/Github/prest/lib/src
[gosec] 2023/05/07 18:30:47 Checking package: helpers
[gosec] 2023/05/07 18:30:47 Checking file: /Users/vmesel/Github/prest/helpers/prest.go
[gosec] 2023/05/07 18:30:47 Import directory: /Users/vmesel/Github/prest/middlewares
[gosec] 2023/05/07 18:30:48 Checking package: main
[gosec] 2023/05/07 18:30:48 Checking file: /Users/vmesel/Github/prest/lib/src/hello.go
[gosec] 2023/05/07 18:30:48 Import directory: /Users/vmesel/Github/prest/controllers
[gosec] 2023/05/07 18:30:49 Import directory: /Users/vmesel/Github/prest/lib/src/middlewares
[gosec] 2023/05/07 18:30:49 Checking package: config
[gosec] 2023/05/07 18:30:49 Checking file: /Users/vmesel/Github/prest/config/config.go
[gosec] 2023/05/07 18:30:49 Import directory: /Users/vmesel/Github/prest/middlewares/statements
[gosec] 2023/05/07 18:30:49 Checking package: middlewares
[gosec] 2023/05/07 18:30:49 Checking file: /Users/vmesel/Github/prest/middlewares/cache.go
[gosec] 2023/05/07 18:30:49 Checking file: /Users/vmesel/Github/prest/middlewares/config.go
[gosec] 2023/05/07 18:30:49 Checking file: /Users/vmesel/Github/prest/middlewares/middlewares.go
[gosec] 2023/05/07 18:30:49 Checking file: /Users/vmesel/Github/prest/middlewares/utils.go
[gosec] 2023/05/07 18:30:49 Import directory: /Users/vmesel/Github/prest/adapters
[gosec] 2023/05/07 18:30:49 Checking package: cache
[gosec] 2023/05/07 18:30:49 Checking file: /Users/vmesel/Github/prest/cache/buntdb.go
[gosec] 2023/05/07 18:30:49 Checking file: /Users/vmesel/Github/prest/cache/cache.go
[gosec] 2023/05/07 18:30:50 Import directory: /Users/vmesel/Github/prest/adapters/mock
[gosec] 2023/05/07 18:30:50 Checking package: plugins
[gosec] 2023/05/07 18:30:50 Checking file: /Users/vmesel/Github/prest/plugins/handler.go
[gosec] 2023/05/07 18:30:50 Checking file: /Users/vmesel/Github/prest/plugins/middleware.go
[gosec] 2023/05/07 18:30:50 Checking package: router
[gosec] 2023/05/07 18:30:50 Checking file: /Users/vmesel/Github/prest/router/router.go
[gosec] 2023/05/07 18:30:50 Import directory: /Users/vmesel/Github/prest/adapters/postgres
[gosec] 2023/05/07 18:30:50 Checking package: main
[gosec] 2023/05/07 18:30:50 Checking file: /Users/vmesel/Github/prest/lib/src/middlewares/hello.go
[gosec] 2023/05/07 18:30:50 Import directory: /Users/vmesel/Github/prest/adapters/postgres/formatters
[gosec] 2023/05/07 18:30:50 Checking package: statements
[gosec] 2023/05/07 18:30:50 Checking file: /Users/vmesel/Github/prest/middlewares/statements/permissions.go
[gosec] 2023/05/07 18:30:50 Import directory: /Users/vmesel/Github/prest/adapters/postgres/internal/connection
[gosec] 2023/05/07 18:30:51 Checking package: cmd
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/auth.go
[gosec] 2023/05/07 18:30:51 Import directory: /Users/vmesel/Github/prest/transactions
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/down.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/migrate.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/mversion.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/next.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/redo.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/reset.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/root.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/up.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/version.go
[gosec] 2023/05/07 18:30:51 Checking package: controllers
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/controllers/auth.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/controllers/databases.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/controllers/healthcheck.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/controllers/schemas.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/controllers/sql.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/controllers/tables.go
[gosec] 2023/05/07 18:30:51 Checking package: main
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/cmd/prestd/main.go
[gosec] 2023/05/07 18:30:51 Checking package: adapters
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/adapters/adapter.go
[gosec] 2023/05/07 18:30:51 Checking file: /Users/vmesel/Github/prest/adapters/scanner.go
[gosec] 2023/05/07 18:30:52 Checking package: mock
[gosec] 2023/05/07 18:30:52 Checking file: /Users/vmesel/Github/prest/adapters/mock/conn.go
[gosec] 2023/05/07 18:30:52 Checking file: /Users/vmesel/Github/prest/adapters/mock/mock.go
[gosec] 2023/05/07 18:30:52 Checking package: formatters
[gosec] 2023/05/07 18:30:52 Checking file: /Users/vmesel/Github/prest/adapters/postgres/formatters/formatters.go
[gosec] 2023/05/07 18:30:52 Checking package: transactions
[gosec] 2023/05/07 18:30:52 Checking file: /Users/vmesel/Github/prest/transactions/transaction.go
[gosec] 2023/05/07 18:30:52 Checking package: connection
[gosec] 2023/05/07 18:30:52 Checking file: /Users/vmesel/Github/prest/adapters/postgres/internal/connection/conn.go
[gosec] 2023/05/07 18:30:52 Checking package: postgres
[gosec] 2023/05/07 18:30:52 Checking file: /Users/vmesel/Github/prest/adapters/postgres/connection.go
[gosec] 2023/05/07 18:30:52 Checking file: /Users/vmesel/Github/prest/adapters/postgres/errors.go
[gosec] 2023/05/07 18:30:52 Checking file: /Users/vmesel/Github/prest/adapters/postgres/postgres.go
[gosec] 2023/05/07 18:30:52 Checking file: /Users/vmesel/Github/prest/adapters/postgres/queries.go
Results:


Github/prest/controllers/auth.go:147] - G401 (CWE-326): Use of weak cryptographic primitive (Confidence: HIGH, Severity: MEDIUM)
    146: 	case "SHA1":
  > 147: 		return fmt.Sprintf("%x", sha1.Sum([]byte(password)))
    148: 	}



Github/prest/controllers/auth.go:145] - G401 (CWE-326): Use of weak cryptographic primitive (Confidence: HIGH, Severity: MEDIUM)
    144: 	case "MD5":
  > 145: 		return fmt.Sprintf("%x", md5.Sum([]byte(password)))
    146: 	case "SHA1":



Github/prest/cmd/root.go:70] - G114 (CWE-676): Use of net/http serve function that has no support for setting timeouts (Confidence: HIGH, Severity: MEDIUM)
    69: 	}
  > 70: 	l.Fatal(http.ListenAndServe(addr, nil))
    71: }



Github/prest/cmd/root.go:68] - G114 (CWE-676): Use of net/http serve function that has no support for setting timeouts (Confidence: HIGH, Severity: MEDIUM)
    67: 	if config.PrestConf.HTTPSMode {
  > 68: 		l.Fatal(http.ListenAndServeTLS(addr, config.PrestConf.HTTPSCert, config.PrestConf.HTTPSKey, nil))
    69: 	}



Github/prest/adapters/postgres/postgres.go:352] - G307 (CWE-703): Deferring unsafe method "Close" on type "io.ReadCloser" (Confidence: HIGH, Severity: MEDIUM)
    351: 	}
  > 352: 	defer r.Body.Close()
    353:



Github/prest/controllers/auth.go:5] - G505 (CWE-327): Blocklisted import crypto/sha1: weak cryptographic primitive (Confidence: HIGH, Severity: MEDIUM)
    4: 	"crypto/md5"
  > 5: 	"crypto/sha1"
    6: 	"encoding/json"



Github/prest/controllers/auth.go:4] - G501 (CWE-327): Blocklisted import crypto/md5: weak cryptographic primitive (Confidence: HIGH, Severity: MEDIUM)
    3: import (
  > 4: 	"crypto/md5"
    5: 	"crypto/sha1"



Github/prest/plugins/handler.go:111] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    110:
  > 111: 	w.Write([]byte(ret.ReturnJson))
    112: }



Github/prest/middlewares/utils.go:72] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    71: 		w.WriteHeader(recorder.Code)
  > 72: 		w.Write(byt)
    73: 	}



Github/prest/middlewares/utils.go:68] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    67: 		w.WriteHeader(recorder.Code)
  > 68: 		w.Write([]byte(xmlStr))
    69: 	default:



Github/prest/controllers/tables.go:504] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    503: 	}
  > 504: 	w.Write(sc.Bytes())
    505: }



Github/prest/controllers/tables.go:475] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    474: 	}
  > 475: 	w.Write(sc.Bytes())
    476: }



Github/prest/controllers/tables.go:406] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    405: 	}
  > 406: 	w.Write(sc.Bytes())
    407: }



Github/prest/controllers/tables.go:348] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    347: 	w.WriteHeader(http.StatusCreated)
  > 348: 	w.Write(sc.Bytes())
    349: }



Github/prest/controllers/tables.go:300] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    299: 	w.WriteHeader(http.StatusCreated)
  > 300: 	w.Write(sc.Bytes())
    301: }



Github/prest/controllers/tables.go:257] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    256: 	cache.BuntSet(r.URL.String(), string(sc.Bytes()))
  > 257: 	w.Write(sc.Bytes())
    258: }



Github/prest/controllers/tables.go:114] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    113: 	}
  > 114: 	w.Write(sc.Bytes())
    115: }



Github/prest/controllers/tables.go:55] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    54: 	}
  > 55: 	w.Write(sc.Bytes())
    56: }



Github/prest/controllers/sql.go:72] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    71: 	//nolint
  > 72: 	w.Write(result)
    73: }



Github/prest/controllers/schemas.go:54] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    53: 	//nolint
  > 54: 	w.Write(sc.Bytes())
    55: }



Github/prest/controllers/databases.go:54] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    53: 	//nolint
  > 54: 	w.Write(sc.Bytes())
    55: }



Github/prest/controllers/auth.go:77] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    76: 		//nolint
  > 77: 		dec.Decode(&login)
    78: 	case "basic":



Github/prest/cache/buntdb.go:63-66] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    62: 		//nolint:errcheck
  > 63: 		tx.Set(key, value,
  > 64: 			&buntdb.SetOptions{
  > 65: 				Expires: true,
  > 66: 				TTL:     time.Duration(cacheTime) * time.Minute})
    67: 		return nil



Github/prest/cache/buntdb.go:61-68] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    60: 	//nolint:errcheck
  > 61: 	db.Update(func(tx *buntdb.Tx) error {
  > 62: 		//nolint:errcheck
  > 63: 		tx.Set(key, value,
  > 64: 			&buntdb.SetOptions{
  > 65: 				Expires: true,
  > 66: 				TTL:     time.Duration(cacheTime) * time.Minute})
  > 67: 		return nil
  > 68: 	})
    69: 	defer db.Close()



Github/prest/cache/buntdb.go:43] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    42: 			w.WriteHeader(http.StatusOK)
  > 43: 			w.Write([]byte(val))
    44: 		}



Github/prest/cache/buntdb.go:37-46] - G104 (CWE-703): Errors unhandled. (Confidence: HIGH, Severity: LOW)
    36: 	//nolint:errcheck
  > 37: 	db.View(func(tx *buntdb.Tx) error {
  > 38: 		val, err := tx.Get(key)
  > 39: 		if err == nil {
  > 40: 			cacheExist = true
  > 41: 			w.Header().Set("Cache-Server", "prestd")
  > 42: 			w.WriteHeader(http.StatusOK)
  > 43: 			w.Write([]byte(val))
  > 44: 		}
  > 45: 		return nil
  > 46: 	})
    47: 	defer db.Close()



Summary:
  Gosec  : dev
  Files  : 50
  Lines  : 5822
  Nosec  : 0
  Issues : 26

3 replies

avelino May 10, 2023
Maintainer Author

@vmesel my proposal would be to use the github action workflow in pull request and branch
https://github.com/securego/gosec#github-action

arxdsilva May 11, 2023
Maintainer

we should definitely work to fix them and then add it to CI, otherwise It'll just break every new PR and be just a point of frustration for everyone.

avelino May 11, 2023
Maintainer Author

@arxdsilva the idea is to give us visibility and bother to prioritize, no need to break the pipeline you can use the allow-failure: true parameter in the workflow

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CI Sec check #817

{{title}}

Replies: 1 comment 3 replies

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

CI Sec check #817

avelino May 6, 2023 Maintainer

Replies: 1 comment · 3 replies

vmesel May 7, 2023 Collaborator

avelino May 10, 2023 Maintainer Author

arxdsilva May 11, 2023 Maintainer

avelino May 11, 2023 Maintainer Author

avelino
May 6, 2023
Maintainer

Replies: 1 comment 3 replies

vmesel
May 7, 2023
Collaborator

avelino May 10, 2023
Maintainer Author

arxdsilva May 11, 2023
Maintainer

avelino May 11, 2023
Maintainer Author