プロジェクトに落とし穴があるかどうかを確認するための Golang 脆弱性スキャン ツール

最近、Go 関係者が脆弱性管理に使用される新しいツールをリリースしたことを発見しました。このツールは、報告された脆弱性を通知し、どのバージョンにアップグレードするかを通知します。

バージョン要件は次のとおりです: Go >= 1.18

go install golang.org/x/vuln/cmd/govulncheck@latest

进入项目目录

govulncheck ./...

出力は次のとおりです

Scanning your code and 470 packages across 91 dependent modules for known vulnerabilities...

Vulnerability #1: GO-2023-2043
    Improper handling of special tags within script contexts in html/template
  More info: https://pkg.go.dev/vuln/GO-2023-2043
  Standard library
    Found in: html/[email protected]
    Fixed in: html/[email protected]
    Example traces found:
      #1: pkg/endless/endless_unix.go:201:24: endless.endlessServer.Serve calls http.Server.Serve, which eventually calls template.Template.Execute
      #2: pkg/endless/endless_unix.go:201:24: endless.endlessServer.Serve calls http.Server.Serve, which eventually calls template.Template.ExecuteTemplate

Vulnerability #2: GO-2023-2041
    Improper handling of HTML-like comments in script contexts in html/template
  More info: https://pkg.go.dev/vuln/GO-2023-2041
  Standard library
    Found in: html/[email protected]
    Fixed in: html/[email protected]
    Example traces found:
      #1: pkg/endless/endless_unix.go:201:24: endless.endlessServer.Serve calls http.Server.Serve, which eventually calls template.Template.Execute
      #2: pkg/endless/endless_unix.go:201:24: endless.endlessServer.Serve calls http.Server.Serve, which eventually calls template.Template.ExecuteTemplate

Vulnerability #3: GO-2023-1987
    Large RSA keys can cause high CPU usage in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2023-1987
  Standard library
    Found in: crypto/[email protected]
    Fixed in: crypto/[email protected]
    Example traces found:
      #1: pkg/gredis/redis.go:22:24: gredis.Setup calls redis.Dial, which calls tls.Conn.Handshake
      #2: pkg/endless/endless_unix.go:201:24: endless.endlessServer.Serve calls http.Server.Serve, which eventually calls tls.Conn.HandshakeContext
      #3: pkg/util/util.go:140:19: util.CreateUuidStringNew calls rand.Read, which eventually calls tls.Conn.Read
      #4: pkg/endless/endless_unix.go:201:24: endless.endlessServer.Serve calls http.Server.Serve, which eventually calls tls.Conn.Write
      #5: pkg/curl/curl.go:62:23: curl.HttpClientRequest calls http.Client.Do, which eventually calls tls.Dialer.DialContext
....
....

GO-2023-2043これは脆弱性番号の後に、脆弱性の説明とそれを修復するための提案が続きます。

具体的な手順については、次の記事を参照してください: https://mp.weixin.qq.com/s/xO_w3FvNN8OeiuEYFarwGQ