generated from adobe/aem-boilerplate
-
Notifications
You must be signed in to change notification settings - Fork 79
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #791 from tsmithv11/sast-update-jul-24
Add new Go policies
- Loading branch information
Showing
22 changed files
with
1,320 additions
and
92 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
81 changes: 81 additions & 0 deletions
81
...erprise-edition/policy-reference/sast-policies/go-policies/sast-policy-200.adoc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| == Weak RSA key length | ||
|
|
||
| === Policy Details | ||
|
|
||
| [width=45%] | ||
| [cols="1,1"] | ||
| |=== | ||
| |Prisma Cloud Policy ID | ||
| | TBD | ||
|
|
||
| |Checkov ID | ||
| |CKV3_SAST_200 | ||
|
|
||
| |Severity | ||
| |MEDIUM | ||
|
|
||
| |Subtype | ||
| |Build | ||
|
|
||
| |Language | ||
| |Go | ||
|
|
||
| |CWEs | ||
| |https://cwe.mitre.org/data/definitions/326.html[CWE-326: Inadequate Encryption Strength] | ||
|
|
||
| |OWASP Categories | ||
| |https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[A02:2021-Cryptographic Failures] | ||
|
|
||
| |=== | ||
|
|
||
| === Description | ||
|
|
||
| This policy identifies instances where RSA keys with less than 2048 bits are generated using the `crypto/rsa` package in Go applications. RSA keys with less than 2048 bits are considered insecure due to their inadequate encryption strength. It is recommended to use RSA keys with at least 2048 bits to ensure sufficient security. | ||
|
|
||
| In this example, the provided code generates a vulnerable RSA key due to its insufficient 2048-bit key length. | ||
|
|
||
| [source,Go] | ||
| ---- | ||
| package main | ||
| import ( | ||
| "crypto/rand" | ||
| "crypto/rsa" | ||
| "log" | ||
| ) | ||
| func main() { | ||
| // Insecure RSA key generation with less than 2048 bits | ||
| key, err := rsa.GenerateKey(rand.Reader, 1024) | ||
| if err != nil { | ||
| log.Fatal(err) | ||
| } | ||
| log.Println("Generated RSA key with 1024 bits:", key) | ||
| } | ||
| ---- | ||
|
|
||
| === Fix - Buildtime | ||
|
|
||
| To mitigate this issue, generate RSA keys with at least 2048 bits. This ensures adequate encryption strength and security. | ||
|
|
||
| In this example, the application generates an RSA key with 2048 bits. | ||
|
|
||
| [source,Go] | ||
| ---- | ||
| package main | ||
| import ( | ||
| "crypto/rand" | ||
| "crypto/rsa" | ||
| "log" | ||
| ) | ||
| func main() { | ||
| // Secure RSA key generation with 2048 bits | ||
| key, err := rsa.GenerateKey(rand.Reader, 2048) | ||
| if err != nil { | ||
| log.Fatal(err) | ||
| } | ||
| log.Println("Generated RSA key with 2048 bits:", key) | ||
| } | ||
| ---- |
79 changes: 79 additions & 0 deletions
79
...erprise-edition/policy-reference/sast-policies/go-policies/sast-policy-239.adoc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| == Usage of weak DES encryption algorithms | ||
|
|
||
| === Policy Details | ||
|
|
||
| [width=45%] | ||
| [cols="1,1"] | ||
| |=== | ||
| |Prisma Cloud Policy ID | ||
| | 35640d3e-f7f7-4289-a97b-a310d4789521 | ||
|
|
||
| |Checkov ID | ||
| |CKV3_SAST_239 | ||
|
|
||
| |Severity | ||
| |MEDIUM | ||
|
|
||
| |Subtype | ||
| |Build | ||
|
|
||
| |Language | ||
| |Go | ||
|
|
||
| |CWEs | ||
| |https://cwe.mitre.org/data/definitions/327.html[CWE-327: Use of a Broken or Risky Cryptographic Algorithm] | ||
|
|
||
| |OWASP Categories | ||
| |https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[A02:2021-Cryptographic Failures] | ||
|
|
||
| |=== | ||
|
|
||
| === Description | ||
|
|
||
| This policy checks whether DES and Triple DES encryption algorithms from the crypto/des package in Go applications are in use. DES encryption algorithms are considered weak due to their small key size and are vulnerable to modern cryptanalysis techniques. Stronger algorithms such as AES from the crypto/des package with larger key sizes are recommended for enhanced security. | ||
|
|
||
| The following code snippet uses the weak and insecure DES encryption algorithm from the crypto/des package. | ||
|
|
||
| [source,Go] | ||
| ---- | ||
| package main | ||
| import ( | ||
| "crypto/des" | ||
| "log" | ||
| ) | ||
| func main() { | ||
| // Insecure use of DES encryption | ||
| key := []byte("weakkey") | ||
| _, err := des.NewCipher(key) | ||
| if err != nil { | ||
| log.Fatal(err) | ||
| } | ||
| } | ||
| ---- | ||
|
|
||
| === Fix - Buildtime | ||
|
|
||
| To mitigate this issue, replace the weak DES encryption with the more secure AES algorithm from the crypto/aes package. | ||
|
|
||
| In this example, the application employs AES encryption rather than DES. | ||
|
|
||
| [source,Go] | ||
| ---- | ||
| package main | ||
| import ( | ||
| "crypto/aes" | ||
| "log" | ||
| ) | ||
| func main() { | ||
| // Secure use of AES encryption | ||
| key := []byte("a very very very very secret key") // 32 bytes for AES-256 | ||
| _, err := aes.NewCipher(key) | ||
| if err != nil { | ||
| log.Fatal(err) | ||
| } | ||
| } | ||
| ---- |
75 changes: 75 additions & 0 deletions
75
...erprise-edition/policy-reference/sast-policies/go-policies/sast-policy-240.adoc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| == Usage of weak MD5 hashing algorithm | ||
|
|
||
| === Policy Details | ||
|
|
||
| [width=45%] | ||
| [cols="1,1"] | ||
| |=== | ||
| |Prisma Cloud Policy ID | ||
| | 7c48cc99-087b-4a47-9a06-54f44f5bf0d8 | ||
|
|
||
| |Checkov ID | ||
| |CKV3_SAST_240 | ||
|
|
||
| |Severity | ||
| |LOW | ||
|
|
||
| |Subtype | ||
| |Build | ||
|
|
||
| |Language | ||
| |Go | ||
|
|
||
| |CWEs | ||
| |https://cwe.mitre.org/data/definitions/328.html[CWE-328: Use of Weak Hash] | ||
|
|
||
| |OWASP Categories | ||
| |https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[A02:2021-Cryptographic Failures] | ||
|
|
||
| |=== | ||
|
|
||
| === Description | ||
|
|
||
| This policy checks whether the MD5 hashing algorithm from the crypto/md5 package is used in Go applications. The MD5 algorithm is cryptographically broken and vulnerable to producing collisions, making it unsuitable for secure hashing. | ||
|
|
||
| In the following example, the application imports the crypto/md5 package and uses the weak and insecure MD5 hashing algorithm. | ||
|
|
||
| [source,Go] | ||
| ---- | ||
| package main | ||
| import ( | ||
| "crypto/md5" | ||
| "fmt" | ||
| ) | ||
| func main() { | ||
| // Insecure use of MD5 hashing | ||
| data := []byte("sensitive data") | ||
| hash := md5.Sum(data) | ||
| fmt.Printf("%x\n", hash) | ||
| } | ||
| ---- | ||
|
|
||
| === Fix - Buildtime | ||
|
|
||
| To mitigate this issue, replace the weak MD5 hashing algorithm with the more robust SHA-256 hashing algorithm from the crypto/sha256 package. SHA-256 provides better security due to its resistance to collision attacks. | ||
|
|
||
| In this example, the application uses SHA-256 hashing instead of the less secure MD5 algorithm. | ||
|
|
||
| [source,Go] | ||
| ---- | ||
| package main | ||
| import ( | ||
| "crypto/sha256" | ||
| "fmt" | ||
| ) | ||
| func main() { | ||
| // Secure use of SHA-256 hashing | ||
| data := []byte("sensitive data") | ||
| hash := sha256.Sum256(data) | ||
| fmt.Printf("%x\n", hash) | ||
| } | ||
| ---- |
Oops, something went wrong.