Skip to content

Commit 8c2b8d8

Browse files
ESS-ENNSakshis
authored and
gatsby003
committed
Add Go TLS rules: min version, SSLv3, cipher suite checks (#154)
* removed missing-secure-java * httponly-false-csharp * use-of-md5-digest-utils-java * removing use-of-md5-digest-utils and httponly-false-csharp * ssl-v3-is-insecure-go * tls-with-insecure-cipher-go * missing-ssl-minversion-go --------- Co-authored-by: Sakshis <sakshil@abc.com>
1 parent 8111747 commit 8c2b8d8

9 files changed

+407
-0
lines changed

‎rules/go/security/missing-ssl-minversion-go.yml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
id: missing-ssl-minversion-go
2+
language: go
3+
severity: warning
4+
message: >-
5+
MinVersion` is missing from this TLS configuration. By default, TLS
6+
1.2 is currently used as the minimum when acting as a client, and TLS 1.0
7+
when acting as a server. General purpose web applications should default
8+
to TLS 1.3 with all other protocols disabled. Only where it is known that
9+
a web server must support legacy clients with unsupported an insecure
10+
browsers (such as Internet Explorer 10), it may be necessary to enable TLS
11+
1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS
12+
configuration to bump the minimum version to TLS 1.3.
13+
note: >-
14+
[CWE-327]: Use of a Broken or Risky Cryptographic Algorithm
15+
[OWASP A03:2017]: Sensitive Data Exposure
16+
[OWASP A02:2021]: Cryptographic Failures
17+
[REFERENCES]
18+
https://owasp.org/Top10/A02_2021-Cryptographic_Failures
19+
20+
ast-grep-essentials: true
21+
22+
utils:
23+
match_tls_without_minversion:
24+
kind: composite_literal
25+
all:
26+
- has:
27+
kind: qualified_type
28+
all:
29+
- has:
30+
kind: package_identifier
31+
regex: "^tls$"
32+
- has:
33+
kind: type_identifier
34+
field: name
35+
regex: "^Config$"
36+
- has:
37+
kind: literal_value
38+
not:
39+
has:
40+
kind: keyed_element
41+
all:
42+
- has:
43+
kind: literal_element
44+
regex: ^MinVersion$
45+
- has:
46+
pattern: $A
47+
rule:
48+
any:
49+
- matches: match_tls_without_minversion
50+

‎rules/go/security/ssl-v3-is-insecure-go.yml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
id: ssl-v3-is-insecure-go
2+
language: go
3+
severity: warning
4+
message: >-
5+
SSLv3 is insecure because it has known vulnerabilities. Starting with
6+
go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.
7+
note: >-
8+
[CWE-327]: Use of a Broken or Risky Cryptographic Algorithm
9+
[OWASP A03:2017]: Sensitive Data Exposure
10+
[OWASP A02:2021]: Cryptographic Failures
11+
[REFERENCES]
12+
https://golang.org/doc/go1.14#crypto/tls
13+
https://www.us-cert.gov/ncas/alerts/TA14-290A
14+
15+
ast-grep-essentials: true
16+
17+
utils:
18+
match_version:
19+
kind: composite_literal
20+
all:
21+
- has:
22+
kind: qualified_type
23+
regex: ^(tls.Config)$
24+
- has:
25+
kind: literal_value
26+
has:
27+
kind: keyed_element
28+
all:
29+
- has:
30+
kind: literal_element
31+
regex: "^MinVersion$"
32+
- has:
33+
kind: literal_element
34+
has:
35+
kind: selector_expression
36+
all:
37+
- has:
38+
kind: identifier
39+
- has:
40+
kind: field_identifier
41+
regex: "^VersionSSL30$"
42+
43+
rule:
44+
any:
45+
- matches: match_version
46+
47+

‎rules/go/security/tls-with-insecure-cipher-go.yml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
id: tls-with-insecure-cipher-go
2+
language: go
3+
severity: warning
4+
message: >-
5+
Detected an insecure CipherSuite via the 'tls' module. This suite is
6+
considered weak. Use the function 'tls.CipherSuites()' to get a list of
7+
good cipher suites. See
8+
https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what
9+
other cipher suites to use.
10+
note: >-
11+
[CWE-327]: Use of a Broken or Risky Cryptographic Algorithm
12+
[OWASP A03:2017]: Sensitive Data Exposure
13+
[OWASP A02:2021]: Cryptographic Failures
14+
[REFERENCES]
15+
https://owasp.org/Top10/A02_2021-Cryptographic_Failures
16+
17+
ast-grep-essentials: true
18+
19+
utils:
20+
match_tls_ciphersuite:
21+
kind: composite_literal
22+
all:
23+
- has:
24+
kind: qualified_type
25+
regex: ^(tls.CipherSuite)$
26+
- has:
27+
kind: literal_value
28+
has:
29+
kind: literal_element
30+
regex: ^(TLS_RSA_WITH_RC4_128_SHA|TLS_RSA_WITH_3DES_EDE_CBC_SHA|TLS_RSA_WITH_AES_128_CBC_SHA256|TLS_ECDHE_ECDSA_WITH_RC4_128_SHA|TLS_ECDHE_RSA_WITH_RC4_128_SHA|TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256)$
31+
method_tls_config:
32+
kind: composite_literal
33+
all:
34+
- has:
35+
kind: qualified_type
36+
regex: ^(tls.Config)$
37+
- has:
38+
stopBy: end
39+
kind: literal_value
40+
has:
41+
stopBy: end
42+
kind: keyed_element
43+
all:
44+
- has:
45+
kind: literal_element
46+
has:
47+
kind: identifier
48+
regex: "^CipherSuites$"
49+
- has:
50+
kind: literal_element
51+
has:
52+
kind: composite_literal
53+
has:
54+
kind: literal_value
55+
has:
56+
kind: literal_element
57+
has:
58+
kind: selector_expression
59+
all:
60+
- has:
61+
kind: identifier
62+
regex: "^tls$"
63+
- has:
64+
kind: field_identifier
65+
regex: ^(TLS_RSA_WITH_RC4_128_SHA|TLS_RSA_WITH_3DES_EDE_CBC_SHA|TLS_RSA_WITH_AES_128_CBC_SHA256|TLS_ECDHE_ECDSA_WITH_RC4_128_SHA|TLS_ECDHE_RSA_WITH_RC4_128_SHA|TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256)$
66+
67+
rule:
68+
any:
69+
- matches: match_tls_ciphersuite
70+
- matches: method_tls_config
71+

‎tests/__snapshots__/missing-ssl-minversion-go-snapshot.yml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: missing-ssl-minversion-go
2+
snapshots:
3+
? |
4+
server.TLS = &tls.Config{ Rand: zeroSource{}, }
5+
: labels:
6+
- source: 'tls.Config{ Rand: zeroSource{}, }'
7+
style: primary
8+
start: 14
9+
end: 47
10+
- source: tls
11+
style: secondary
12+
start: 14
13+
end: 17
14+
- source: Config
15+
style: secondary
16+
start: 18
17+
end: 24
18+
- source: tls.Config
19+
style: secondary
20+
start: 14
21+
end: 24
22+
- source: '{ Rand: zeroSource{}, }'
23+
style: secondary
24+
start: 24
25+
end: 47

‎tests/__snapshots__/ssl-v3-is-insecure-go-snapshot.yml

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
id: ssl-v3-is-insecure-go
2+
snapshots:
3+
? |
4+
client := &http.Client{
5+
Transport: &http.Transport{
6+
// ruleid: ssl-v3-is-insecure
7+
TLSClientConfig: &tls.Config{
8+
KeyLogWriter: w,
9+
MinVersion: tls.VersionSSL30,
10+
Rand: zeroSource{}, // for reproducible output; don't do this.
11+
InsecureSkipVerify: true, // test server certificate is not trusted.
12+
},
13+
},
14+
}
15+
: labels:
16+
- source: |-
17+
tls.Config{
18+
KeyLogWriter: w,
19+
MinVersion: tls.VersionSSL30,
20+
Rand: zeroSource{}, // for reproducible output; don't do this.
21+
InsecureSkipVerify: true, // test server certificate is not trusted.
22+
}
23+
style: primary
24+
start: 107
25+
end: 358
26+
- source: tls.Config
27+
style: secondary
28+
start: 107
29+
end: 117
30+
- source: MinVersion
31+
style: secondary
32+
start: 152
33+
end: 162
34+
- source: tls
35+
style: secondary
36+
start: 172
37+
end: 175
38+
- source: VersionSSL30
39+
style: secondary
40+
start: 176
41+
end: 188
42+
- source: tls.VersionSSL30
43+
style: secondary
44+
start: 172
45+
end: 188
46+
- source: tls.VersionSSL30
47+
style: secondary
48+
start: 172
49+
end: 188
50+
- source: 'MinVersion: tls.VersionSSL30'
51+
style: secondary
52+
start: 152
53+
end: 188
54+
- source: |-
55+
{
56+
KeyLogWriter: w,
57+
MinVersion: tls.VersionSSL30,
58+
Rand: zeroSource{}, // for reproducible output; don't do this.
59+
InsecureSkipVerify: true, // test server certificate is not trusted.
60+
}
61+
style: secondary
62+
start: 117
63+
end: 358

‎tests/__snapshots__/tls-with-insecure-cipher-go-snapshot.yml

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
id: tls-with-insecure-cipher-go
2+
snapshots:
3+
? |
4+
tr := &http.Transport{
5+
TLSClientConfig: &tls.Config{CipherSuites: []uint16{
6+
tls.TLS_RSA_WITH_RC4_128_SHA,
7+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
8+
}},
9+
}
10+
: labels:
11+
- source: |-
12+
tls.Config{CipherSuites: []uint16{
13+
tls.TLS_RSA_WITH_RC4_128_SHA,
14+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
15+
}}
16+
style: primary
17+
start: 41
18+
end: 151
19+
- source: tls.Config
20+
style: secondary
21+
start: 41
22+
end: 51
23+
- source: CipherSuites
24+
style: secondary
25+
start: 52
26+
end: 64
27+
- source: CipherSuites
28+
style: secondary
29+
start: 52
30+
end: 64
31+
- source: tls
32+
style: secondary
33+
start: 78
34+
end: 81
35+
- source: TLS_RSA_WITH_RC4_128_SHA
36+
style: secondary
37+
start: 82
38+
end: 106
39+
- source: tls.TLS_RSA_WITH_RC4_128_SHA
40+
style: secondary
41+
start: 78
42+
end: 106
43+
- source: tls.TLS_RSA_WITH_RC4_128_SHA
44+
style: secondary
45+
start: 78
46+
end: 106
47+
- source: |-
48+
{
49+
tls.TLS_RSA_WITH_RC4_128_SHA,
50+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
51+
}
52+
style: secondary
53+
start: 74
54+
end: 150
55+
- source: |-
56+
[]uint16{
57+
tls.TLS_RSA_WITH_RC4_128_SHA,
58+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
59+
}
60+
style: secondary
61+
start: 66
62+
end: 150
63+
- source: |-
64+
[]uint16{
65+
tls.TLS_RSA_WITH_RC4_128_SHA,
66+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
67+
}
68+
style: secondary
69+
start: 66
70+
end: 150
71+
- source: |-
72+
CipherSuites: []uint16{
73+
tls.TLS_RSA_WITH_RC4_128_SHA,
74+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
75+
}
76+
style: secondary
77+
start: 52
78+
end: 150
79+
- source: |-
80+
{CipherSuites: []uint16{
81+
tls.TLS_RSA_WITH_RC4_128_SHA,
82+
tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
83+
}}
84+
style: secondary
85+
start: 51
86+
end: 151

‎tests/go/missing-ssl-minversion-go-test.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
id: missing-ssl-minversion-go
2+
valid:
3+
- |
4+
TLSClientConfig: &tls.Config{
5+
KeyLogWriter: w,
6+
MinVersion: tls.VersionSSL30,
7+
Rand: zeroSource{},
8+
InsecureSkipVerify: true,
9+
},
10+
11+
invalid:
12+
- |
13+
server.TLS = &tls.Config{ Rand: zeroSource{}, }
14+
15+

‎tests/go/ssl-v3-is-insecure-go-test.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: ssl-v3-is-insecure-go
2+
valid:
3+
- |
4+
client_good := &http.Client{
5+
Transport: &http.Transport{
6+
TLSClientConfig: &tls.Config{
7+
KeyLogWriter: w,
8+
// OK
9+
MinVersion: tls.VersionTLS10,
10+
Rand: zeroSource{}, // for reproducible output; don't do this.
11+
InsecureSkipVerify: true, // test server certificate is not trusted.
12+
},
13+
},
14+
}
15+
16+
invalid:
17+
- |
18+
client := &http.Client{
19+
Transport: &http.Transport{
20+
// ruleid: ssl-v3-is-insecure
21+
TLSClientConfig: &tls.Config{
22+
KeyLogWriter: w,
23+
MinVersion: tls.VersionSSL30,
24+
Rand: zeroSource{}, // for reproducible output; don't do this.
25+
InsecureSkipVerify: true, // test server certificate is not trusted.
26+
},
27+
},
28+
}
29+
30+

0 commit comments

Comments
 (0)