Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Simplify Repo File Parsing #167

Merged
merged 6 commits into from
Jul 19, 2024
Merged

Simplify Repo File Parsing #167

merged 6 commits into from
Jul 19, 2024

Conversation

SUSTAPLE117
Copy link
Contributor

@SUSTAPLE117 SUSTAPLE117 commented Jul 17, 2024

Simplifies parsing by walking files only once. Fixes #161

Copy link

⚠️  2 New Security Findings

The latest commit contains 2 new security findings.

Findings
G304: File path provided as taint input
The software does not properly neutralize special elements within the pathname.

Potential file inclusion via variable
 📘 Learn More
data, err := os.ReadFile(filePath)
G304: File path provided as taint input
The software does not properly neutralize special elements within the pathname.

Potential file inclusion via variable
 📘 Learn More
data, err := os.ReadFile(workflowFilePath)

Not a finding? Ignore it by adding a comment on the line with just the word noboost.

Scanner: boostsecurity - BoostSecurity gosec

@SUSTAPLE117 SUSTAPLE117 marked this pull request as ready for review July 18, 2024 18:42
@SUSTAPLE117 SUSTAPLE117 requested a review from a team as a code owner July 18, 2024 18:42
Copy link
Contributor

@fproulx-boostsecurity fproulx-boostsecurity left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some improvements to regexes needed

scanner/scanner.go Outdated Show resolved Hide resolved
scanner/scanner.go Show resolved Hide resolved
@SUSTAPLE117 SUSTAPLE117 merged commit 20feb8b into main Jul 19, 2024
8 checks passed
@SUSTAPLE117 SUSTAPLE117 deleted the maint/fileWalks branch July 19, 2024 19:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Improve parsing to avoid looping multiple times over all files
2 participants