Go: Recognize unsafe candidate selection in go/insecure-randomness
#15294
Conversation
|
DCA looks uneventful. |
|
Have you considered running MRVA (either for the whole query or just the step you're adding) to check that this doesn't cause too many FPs? |
* Restrict allowed types in the flow step * Discard more non-crypto-related TLS APIs
|
That's a good idea. After evaluating the top 1k Go projects (using flow states to only see results caused by this flow step), I could identify several FPs caused by either:
After adding the appropriate exclusions in 12c5b46, there's only 1 more FP in the top 1k projects, which is caused by the password name heuristic and not by the flow step, so I think it's acceptable. |
|
My only slight misgiving is that you've done several small things which aren't mentioned in the change note. Maybe you could add something to say that some changes have been made to reduce false positives? Up to you. |
|
Won't hurt — done here :) |
This PR adds a flow step so that
go/insecure-randomnessrecognizes the pattern of randomly selecting a character/substring from a predefined set with a weak RNG, which is a security risk if the result is used in a sensitive function.Adds coverage for CVE-2023-46740.