Bind to all interfaces GSC-G102
Binding to all network interfaces can potentially open up a service to traffic on unintended interfaces.
Import blacklist: crypto/des GSC-G502
Detects imports of crypto/des since they are considered vulnerable.
Import blacklist: crypto/rc4 GSC-G503
Detects imports of crypto/rc4 since it is considered vulnerable.
Import blacklist: net/http/cgi GSC-G504
Use of net/http/cgi is considered vulnerable in versions of Go lower than
1.15.1
Function call made to an unsafe package GSC-G103
Package unsafe contains operations that step around the type safety of Go
programs and may be non-portable. Also note that unsafe package is not
supported by Go 1 compatibility guidelines.
Import blacklist: crypto/sha1 GSC-G505
Detects imports of crypto/sha1 since they are considered vulnerable.
Poor file permissions used when creating a directory GSC-G301
Excessive permissions granted when creating a directory. This warning is
triggered whenever permission greater than 0750 is given.
Poor file permissions used when creating a file or using os.Chmod GSC-G302
Excessive permissions granted to a file/directory. This warning is triggered whenever permission greater than 0600 is granted.
Creating tempfile using a predictable path GSC-G303
Use os.TempDir, ioutil.TempDir and ioutil.TempFile() to ensure filepath generated is correct and not predictable.
Audit the use of ssh.InsecureIgnoreHostKey function GSC-G106
InsecureIgnoreHostKey is used to accept any host key. It should not be used for production code.
Audit the usage of unescaped data in HTML templates GSC-G203
Potential unescaped data in HTML template.
Audit the random number generation source (rand) GSC-G404
math/rand is much faster for applications that don’t need crypto-level or security-related random data generation. crypto/rand is suited for secure and crypto-ready usage, but it’s slower. But in most cases, crypto/rand is likely to be more suitable, unless the performance is critical but the application's security is not (which is rare).
File path traversal when extracting zip archive GSC-G305
A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder.
Potential usage of DES, RC4, MD5 or SHA1 GSC-G401
DES, RC4, MD5, and SHA1 are relatively weak encryption/hashing algorithms. Consider using a more secure alternative.
Potentially bad TLS connection settings GSC-G402
Insecure configuration of TLS connection settings. Refer to the occurrence to understand the exact misconfiguration.
RSA key length less than 2048 bits GSC-G403
The strength of public-key-based cryptographic algorithm (like RSA) is determined by the time that it takes to derive the private key by using brute-force methods. RSA claims that 1024-bit keys are likely to become crackable some time between 2006 and 2010 and that 2048-bit keys are sufficient until 2030.
Import blacklist: crypto/md5 GSC-G501
Detects imports of crypto/md5 since they are considered vulnerable.
Audit required: Insecure gRPC server GO-S0902
gRPC is designed to work with various authentication mechanisms, making it easy to use gRPC to talk to other systems. It is recommended to use the supported authentication mechanisms to shield against multiple types of attacks (e.g., MITM - Man in the Middle Attack).
Audit required: XML package may be vulnerable to XXE attacks GO-S0903
XML specification allows the use of entities that can be internal or external
(file system/network access, etc.) which could lead to vulnerabilities such as
SSRF or confidential file disclosures. XML package (Go binding to libxml2)
might be vulnerable to XXE attacks. When dealing with external entities, one
must be very careful when using the package, allowing an attacker to access
sensitive data on the filesystem.
Audit required: Insecure use of logger GO-S0904
Possible insecure use of logger because of tainted, untrusted, or sensitive arguments passed to the logger. Logging invalidated user input can allow an attacker to forge log entries or inject malicious content into the logs.