open-vault/tools/semgrep/ci/logger-format-string.yml
Hridoy Roy 7e0abe3c7e
Add Semgrep Rules to OSS (#14513)
* add semgrep yml

* add semgrep ci job

* remove replication semgrep rule in oss

* fix makefile

* add semgrep to ci

* upwind triple if in ui.go semgrep refactoring
2022-03-18 11:14:03 -07:00

22 lines
723 B
YAML

rules:
- id: logger-used-with-format-string
patterns:
- pattern-either:
- pattern: |
$LOGGER.Trace("=~/.*%[v#T%tbcdoOqxXUbeEfFgGps].*/",...)
- pattern: |
$LOGGER.Debug("=~/.*%[v#T%tbcdoOqxXUbeEfFgGps].*/",...)
- pattern: |
$LOGGER.Info("=~/.*%[v#T%tbcdoOqxXUbeEfFgGps].*/",...)
- pattern: |
$LOGGER.Warn("=~/.*%[v#T%tbcdoOqxXUbeEfFgGps].*/",...)
- pattern: |
$LOGGER.Error("=~/.*%[v#T%tbcdoOqxXUbeEfFgGps].*/",...)
- pattern-inside: |
import $LOG "github.com/hashicorp/go-hclog"
...
message: "Logger message looks like format string"
languages: [go]
severity: ERROR