Skip to content

Commit de8d0d2

Browse files
ESS-ENNgatsby003
ESS-ENN
authored and
gatsby003
committed
Two Go rules 10Oct2024 (#15)
* ssl-v3-is-insecure-go * missing-ssl-minversion-go
1 parent 733925a commit de8d0d2

File tree

6 files changed

+127
-0
lines changed

6 files changed

+127
-0
lines changed

‎rules/go/security/missing-ssl-minversion-go.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
id: missing-ssl-minversion-go
2+
language: go
3+
severity: warning
4+
message: >-
5+
MinVersion` is missing from this TLS configuration. By default, TLS
6+
1.2 is currently used as the minimum when acting as a client, and TLS 1.0
7+
when acting as a server. General purpose web applications should default
8+
to TLS 1.3 with all other protocols disabled. Only where it is known that
9+
a web server must support legacy clients with unsupported an insecure
10+
browsers (such as Internet Explorer 10), it may be necessary to enable TLS
11+
1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS
12+
configuration to bump the minimum version to TLS 1.3.
13+
note: >-
14+
[CWE-327]: Use of a Broken or Risky Cryptographic Algorithm
15+
[OWASP A03:2017]: Sensitive Data Exposure
16+
[OWASP A02:2021]: Cryptographic Failures
17+
[REFERENCES]
18+
https://owasp.org/Top10/A02_2021-Cryptographic_Failures
19+
utils:
20+
match_tls_without_minversion:
21+
kind: composite_literal
22+
pattern: $R
23+
inside:
24+
stopBy: end
25+
kind: assignment_statement
26+
rule:
27+
any:
28+
- matches: match_tls_without_minversion
29+
constraints:
30+
R:
31+
regex: ^(tls.Config)

‎rules/go/security/ssl-v3-is-insecure-go.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
id: ssl-v3-is-insecure-go
2+
language: go
3+
severity: warning
4+
message: >-
5+
SSLv3 is insecure because it has known vulnerabilities. Starting with
6+
go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.
7+
note: >-
8+
[CWE-327]: Use of a Broken or Risky Cryptographic Algorithm
9+
[OWASP A03:2017]: Sensitive Data Exposure
10+
[OWASP A02:2021]: Cryptographic Failures
11+
[REFERENCES]
12+
https://golang.org/doc/go1.14#crypto/tls
13+
https://www.us-cert.gov/ncas/alerts/TA14-290A
14+
rule:
15+
kind: composite_literal
16+
all:
17+
- pattern: "tls.Config{$$$, MinVersion: tls.VersionSSL30, $$$}"

‎tests/__snapshots__/missing-ssl-minversion-go-snapshot.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: missing-ssl-minversion-go
2+
snapshots:
3+
? |
4+
server.TLS = &tls.Config{ Rand: zeroSource{}, }
5+
: labels:
6+
- source: 'tls.Config{ Rand: zeroSource{}, }'
7+
style: primary
8+
start: 14
9+
end: 47
10+
- source: 'server.TLS = &tls.Config{ Rand: zeroSource{}, }'
11+
style: secondary
12+
start: 0
13+
end: 47

‎tests/__snapshots__/ssl-v3-is-insecure-go-snapshot.yml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: ssl-v3-is-insecure-go
2+
snapshots:
3+
? |
4+
client := &http.Client{
5+
Transport: &http.Transport{
6+
// ruleid: ssl-v3-is-insecure
7+
TLSClientConfig: &tls.Config{
8+
KeyLogWriter: w,
9+
MinVersion: tls.VersionSSL30,
10+
Rand: zeroSource{}, // for reproducible output; don't do this.
11+
InsecureSkipVerify: true, // test server certificate is not trusted.
12+
},
13+
},
14+
}
15+
: labels:
16+
- source: |-
17+
tls.Config{
18+
KeyLogWriter: w,
19+
MinVersion: tls.VersionSSL30,
20+
Rand: zeroSource{}, // for reproducible output; don't do this.
21+
InsecureSkipVerify: true, // test server certificate is not trusted.
22+
}
23+
style: primary
24+
start: 107
25+
end: 358

‎tests/go/missing-ssl-minversion-go-test.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: missing-ssl-minversion-go
2+
valid:
3+
- |
4+
TLSClientConfig: &tls.Config{
5+
KeyLogWriter: w,
6+
MinVersion: tls.VersionSSL30,
7+
Rand: zeroSource{},
8+
InsecureSkipVerify: true,
9+
},
10+
11+
invalid:
12+
- |
13+
server.TLS = &tls.Config{ Rand: zeroSource{}, }

‎tests/go/ssl-v3-is-insecure-go-test.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
id: ssl-v3-is-insecure-go
2+
valid:
3+
- |
4+
client_good := &http.Client{
5+
Transport: &http.Transport{
6+
TLSClientConfig: &tls.Config{
7+
KeyLogWriter: w,
8+
// OK
9+
MinVersion: tls.VersionTLS10,
10+
Rand: zeroSource{}, // for reproducible output; don't do this.
11+
InsecureSkipVerify: true, // test server certificate is not trusted.
12+
},
13+
},
14+
}
15+
16+
invalid:
17+
- |
18+
client := &http.Client{
19+
Transport: &http.Transport{
20+
// ruleid: ssl-v3-is-insecure
21+
TLSClientConfig: &tls.Config{
22+
KeyLogWriter: w,
23+
MinVersion: tls.VersionSSL30,
24+
Rand: zeroSource{}, // for reproducible output; don't do this.
25+
InsecureSkipVerify: true, // test server certificate is not trusted.
26+
},
27+
},
28+
}

0 commit comments

Comments
 (0)