Create rule S5527: Server hostnames should be verified during SSL/TLS connections for go (#4656)
* Add go to rule S5527 * Add text * Fix wording * Fix wording++ * Update rules/S5527/go/how-to-fix-it/std.adoc Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com> * Move fix it section into the main adoc * Fix non-compliant->noncompliant --------- Co-authored-by: teemu-rytilahti-sonarsource <teemu-rytilahti-sonarsource@users.noreply.github.com> Co-authored-by: Teemu Rytilahti <teemu.rytilahti@sonarsource.com> Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
This commit is contained in:
parent
4903879d09
commit
2619fbcace
3
rules/S5527/go/metadata.json
Normal file
3
rules/S5527/go/metadata.json
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
{
|
||||||
|
|
||||||
|
}
|
67
rules/S5527/go/rule.adoc
Normal file
67
rules/S5527/go/rule.adoc
Normal file
@ -0,0 +1,67 @@
|
|||||||
|
include::../summary.adoc[]
|
||||||
|
|
||||||
|
== Why is this an issue?
|
||||||
|
|
||||||
|
include::../rationale.adoc[]
|
||||||
|
|
||||||
|
include::../impact.adoc[]
|
||||||
|
|
||||||
|
// How to fix it section
|
||||||
|
|
||||||
|
== How to fix it
|
||||||
|
|
||||||
|
=== Code examples
|
||||||
|
|
||||||
|
include::../common/fix/code-rationale.adoc[]
|
||||||
|
|
||||||
|
Hostname validation is disabled if ``++InsecureSkipVerify++`` is set to `true` for ``++TLSClientConfig++`` used for the transport class.
|
||||||
|
|
||||||
|
For HTTPS, it is recommended to use high-level interfaces (like ``++http.Get()++``), which perform the certificate validation instead of using ``++http.Client++`` directly.
|
||||||
|
|
||||||
|
==== Noncompliant code example
|
||||||
|
|
||||||
|
[source,go,diff-id=1,diff-type=noncompliant]
|
||||||
|
----
|
||||||
|
client := &http.Client{
|
||||||
|
Transport: &http.Transport{
|
||||||
|
TLSClientConfig: &tls.Config{
|
||||||
|
InsecureSkipVerify: true, // Noncompliant
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
client.Get("https://example.com")
|
||||||
|
----
|
||||||
|
|
||||||
|
==== Compliant solution
|
||||||
|
|
||||||
|
Usage of high-level interfaces is recommended:
|
||||||
|
[source,go,diff-id=1,diff-type=compliant]
|
||||||
|
----
|
||||||
|
http.Get("https://example.com")
|
||||||
|
----
|
||||||
|
|
||||||
|
=== How does this work?
|
||||||
|
|
||||||
|
include::../common/fix/validation.adoc[]
|
||||||
|
|
||||||
|
== Resources
|
||||||
|
|
||||||
|
include::../common/resources/standards.adoc[]
|
||||||
|
|
||||||
|
ifdef::env-github,rspecator-view[]
|
||||||
|
|
||||||
|
'''
|
||||||
|
== Implementation Specification
|
||||||
|
(visible only on this page)
|
||||||
|
|
||||||
|
include::../message.adoc[]
|
||||||
|
|
||||||
|
'''
|
||||||
|
== Comments And Links
|
||||||
|
(visible only on this page)
|
||||||
|
|
||||||
|
include::../comments-and-links.adoc[]
|
||||||
|
|
||||||
|
endif::env-github,rspecator-view[]
|
||||||
|
|
Loading…
x
Reference in New Issue
Block a user