search

ZupIT / horusec

Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.
https://horusec.io/
Apache License 2.0
1.13k stars 184 forks source link

HS-LEAKS: False positive in go.sum (linkedin...) #1160

Open stefanb opened 11 months ago

stefanb commented 11 months ago

When a Go program uses a module from Linkedin (eg https://github.com/linkedin/goavro ) the name will be mentioned in go.sum file followed by a hash on the same line, eg:

github.com/linkedin/goavro v2.1.0+incompatible/go.mod h1:bBCwI2eGYpUI/4820s67MElg9tdeLbINjLjiM2xZFYM=
github.com/linkedin/goavro/v2 v2.10.0/go.mod h1:UgQUb2N/pmueQYH9bfqFioWxzYCZXSfF8Jw03O5sjqA=
github.com/linkedin/goavro/v2 v2.10.1/go.mod h1:UgQUb2N/pmueQYH9bfqFioWxzYCZXSfF8Jw03O5sjqA=
github.com/linkedin/goavro/v2 v2.11.1/go.mod h1:UgQUb2N/pmueQYH9bfqFioWxzYCZXSfF8Jw03O5sjqA=

...which triggers a false positive via regexp in:

https://github.com/ZupIT/horusec/blob/873d4104a6aa89be8f86d93db8e416909d9add87/internal/services/engines/leaks/rules.go#L171-L187

This likely affects other LEAKS rulesc with loose regexp and companies publishing opensource libraries.