Cosmin Cojocar comments

Results 156 comments of


                                            Cosmin Cojocar

No issues reported for secDevLabs (vulnerable apps)

I think on a first look that we should detect this issue, but it seems that somehow the SQL rule doesn't. This looks like a bug to me.

No issues reported for secDevLabs (vulnerable apps)

SQL injections rule needs a revamp to catch more advanced issue. Closing this for now.

G104 fails to catch err reassignments

@TimonOmsk feel free to take on this issue. Thanks

Check if package make syscalls

This sounds interesting. I think that is valuable for auditing code. I will be happy to receive such a contribution.

G306 triggered on executable bit set

Creating a file with execute permission can lead to a RCE if the attack is able to control the input. This is not the case in the example above since...

G306 triggered on executable bit set

> Do you have any suggestions for an improvement? The first two ideas that came to my mind: > Expect WriteFile permissions to be a subset of 0600 > or:...

Query builders hide SQL vulnerabilities

I would to cover standard library for now. Thanks

Does not flag potential injection if entire query is user-submitted

SQL injection rule needs a revamping. Closing this for now.

nosec statement ignored when additionally defined in front of function, const or variable segment

The nonsec directive was refactored to be more fined-grained instead of ignoring an entire AST node.

net/url: (CWE-532) Check if Unredacted URLs are Printed/Logged

@adambkaplan It looks like an interesting suggestion. I am happy to accept any contribution if you can put a rule together. if you need any help, we can guide you....