Skip to content
This repository was archived by the owner on Nov 2, 2023. It is now read-only.

Commit d43b63d

Browse files
author
Julio Guerra
committed
v0.16.0
New Feature: - (#152, #155) Add In-App WAF protection to Echo's request parameter parser: [`Context`](https://pkg.go.dev/github.com/labstack/echo/v4#Context)'s method `Bind()` is now protected by the In-App WAF. The Go value it parses from the HTTP request is made available to the In-App WAF rules via the `GET/POST parameters` field. When blocked, `Bind()` returns a non-nil [`SqreenError` value](https://godoc.org/github.com/sqreen/go-agent/sdk/types#SqreenError) and its caller should immediately return. Read more about the blocking behavior of Sqreen for Go at <https://docs.sqreen.com/go/integration>. Fix: - (#153) RASP shellshock: properly handle environment variables containing variable definitions (eg. `TERMCAP`).
2 parents 23bbad3 + 50d9cb1 commit d43b63d

File tree

9 files changed

+799
-62
lines changed

9 files changed

+799
-62
lines changed

‎CHANGELOG.md

+19
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,22 @@
1+
# v0.16.0 - 22 September 2020
2+
3+
## New Feature
4+
5+
- (#152, #155) Add In-App WAF protection to Echo's request parameter parser:
6+
[`Context`](https://pkg.go.dev/github.com/labstack/echo/v4#Context)'s method
7+
`Bind()` is now protected by the In-App WAF. The Go value it parses from the
8+
HTTP request is made available to the In-App WAF rules via the
9+
`GET/POST parameters` field.
10+
When blocked, `Bind()` returns a non-nil [`SqreenError` value](https://godoc.org/github.com/sqreen/go-agent/sdk/types#SqreenError)
11+
and its caller should immediately return.
12+
Read more about the blocking behavior of Sqreen for Go at <https://docs.sqreen.com/go/integration>.
13+
14+
## Fix
15+
16+
- (#153) RASP shellshock: properly handle environment variables containing
17+
variable definitions (eg. `TERMCAP`).
18+
19+
120
# v0.15.0 - 9 September 2020
221

322
## New Feature

‎README.md

+20-35
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,6 @@
44

55
# [Sqreen](https://www.sqreen.com/)'s Application Security Management for Go
66

7-
[![Release](https://img.shields.io/github/release/sqreen/go-agent.svg)](https://github.com/sqreen/go-agent/releases)
8-
[![GoDoc](https://godoc.org/github.com/sqreen/go-agent?status.svg)](https://godoc.org/github.com/sqreen/go-agent)
9-
[![Go Report Card](https://goreportcard.com/badge/github.com/sqreen/go-agent)](https://goreportcard.com/report/github.com/sqreen/go-agent)
10-
[![Build Status](https://dev.azure.com/sqreenci/Go%20Agent/_apis/build/status/sqreen.go-agent?branchName=master)](https://dev.azure.com/sqreenci/Go%20Agent/_build/latest?definitionId=8&branchName=master)
11-
127
After performance monitoring (APM), error and log monitoring it’s time to add a
138
security component into your app. Sqreen’s microagent automatically monitors
149
sensitive app’s routines, blocks attacks and reports actionable infos to your
@@ -34,41 +29,29 @@ For more details, visit [sqreen.com](https://www.sqreen.com/)
3429
# Quick start
3530

3631
1. Use the middleware function for the Go web framework you use:
37-
- [sqhttp](https://godoc.org/github.com/sqreen/go-agent/sdk/middleware/sqhttp) for the standard `net/http` package.
38-
- [Gin](https://godoc.org/github.com/sqreen/go-agent/sdk/middleware/sqgin) for `github.com/gin-gonic/gin`.
39-
- [Echo](https://godoc.org/github.com/sqreen/go-agent/sdk/middleware/sqecho) for `github.com/labstack/echo`.
32+
- [net/http](https://godoc.org/github.com/sqreen/go-agent/sdk/middleware/sqhttp)
33+
- [Gin](https://godoc.org/github.com/sqreen/go-agent/sdk/middleware/sqgin)
34+
- [Echo](https://godoc.org/github.com/sqreen/go-agent/sdk/middleware/sqecho/v4)
4035

4136
If your framework is not listed, it is usually possible to use instead the
4237
standard `net/http` middleware. If not, please, let us know by [creating an
4338
issue](http://github.com/sqreen/go-agent/issues/new).
4439

45-
1. Without Go modules: Download the new dependencies
46-
47-
`go get` will automatically download the new dependencies of the SDK, including
48-
Sqreen's agent for Go:
49-
50-
```consol
51-
$ go get -d -v ./...
52-
```
53-
5440
1. Compile your program with Sqreen
5541

5642
Sqreen's dynamic configuration of your protection is made possible thanks to
5743
Go instrumentation. It is safely performed at compilation time by the following
5844
instrumentation tool.
5945

60-
Install the following instrumentation tool and compile your program using it in
61-
order to enable Sqreen.
46+
Install the following instrumentation tool and compile your program using it
47+
in order to enable Sqreen.
6248

63-
1. Use `go install` to compile the instrumentation tool:
49+
1. Use `go build` to download and compile the instrumentation tool:
6450

6551
```console
66-
$ go install github.com/sqreen/go-agent/sdk/sqreen-instrumentation
52+
$ go build github.com/sqreen/go-agent/sdk/sqreen-instrumentation
6753
```
6854

69-
By default, the resulting `sqreen-instrumentation` tool is installed in the
70-
`bin` directory of the `GOPATH`. You can find it using `go env GOPATH`.
71-
7255
1. Configure the Go toolchain to use it:
7356

7457
Use the instrumentation tool using the go options
@@ -79,15 +62,15 @@ For more details, visit [sqreen.com](https://www.sqreen.com/)
7962
8063
For example, the following two commands are equivalent:
8164
```console
82-
$ go build -a -toolexec $(go env GOPATH)/bin/sqreen-instrumentation my-project
83-
$ env GOFLAGS="-a -toolexec $(go env GOPATH)/bin/sqreen-instrumentation" go build my-project
65+
$ go build -a -toolexec $PWD/sqreen-instrumentation-tool my-project
66+
$ env GOFLAGS="-a -toolexec $PWD/sqreen-instrumentation-tool" go build my-project
8467
```
8568
8669
1. [Signup to Sqreen](https://my.sqreen.io/signup) to get a token for your app,
8770
and store it in the agent's configuration file `sqreen.yaml`:
8871
8972
```sh
90-
app_name: Your Go service name
73+
app_name: Your Go app name
9174
token: your token
9275
```
9376
@@ -96,13 +79,15 @@ For more details, visit [sqreen.com](https://www.sqreen.com/)
9679
path by defining the configuration file location into the environment
9780
variable `SQREEN_CONFIG_FILE`.
9881

99-
1. You are done!
100-
Just recompile your Go program and the go toolchain will download the latests
101-
agent version.
82+
Congratulations, your Go web application is now protected by Sqreen!
83+
84+
<p align="center">
85+
<img width="60%" src="./doc/images/blocking-page-with-gopher.png" alt="Sqreen for Go" title="Sqreen for Go" />
86+
</p>
87+
10288

103-
1. Optionally, use the [SDK](https://godoc.org/github.com/sqreen/go-agent/sdk)
104-
to perform [user monitoring](https://godoc.org/github.com/sqreen/go-agent/sdk#HTTPRequestRecord.ForUser)
105-
(eg. signing-in) or [custom security events](https://godoc.org/github.com/sqreen/go-agent/sdk#HTTPRequestRecord.TrackEvent)
106-
you would like to track (eg. password changes).
89+
# Advanced integration
10790

108-
Find out more about the agent setup at https://docs.sqreen.com/go/installation/
91+
Optionally, use the SDK to perform [user monitoring](https://docs.sqreen.com/go/user-monitoring/)
92+
or [custom security events](https://docs.sqreen.com/go/custom-events/) you would
93+
like to track and possibly block.

‎go.mod

+4-7
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,8 @@ require (
1616
github.com/json-iterator/go v1.1.9 // indirect
1717
github.com/kentik/patricia v0.0.0-20190405133149-20eb46c597b3
1818
github.com/labstack/echo v3.3.10+incompatible
19-
github.com/labstack/gommon v0.2.9 // indirect
19+
github.com/labstack/echo/v4 v4.1.17
2020
github.com/magiconair/properties v1.8.1 // indirect
21-
github.com/mattn/go-colorable v0.1.4 // indirect
22-
github.com/mattn/go-isatty v0.0.11 // indirect
2321
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
2422
github.com/modern-go/reflect2 v1.0.1 // indirect
2523
github.com/onsi/ginkgo v1.7.0
@@ -30,11 +28,10 @@ require (
3028
github.com/spf13/viper v1.3.2
3129
github.com/sqreen/go-libsqreen v0.7.1
3230
github.com/sqreen/go-sdk/signal v1.1.0
31+
github.com/stretchr/objx v0.2.0 // indirect
3332
github.com/stretchr/testify v1.6.1
34-
golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37 // indirect
35-
golang.org/x/net v0.0.0-20200513185701-a91f0712d120
36-
golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9 // indirect
37-
golang.org/x/text v0.3.2 // indirect
33+
golang.org/x/net v0.0.0-20200904194848-62affa334b73
34+
golang.org/x/sys v0.0.0-20200918174421-af09f7315aff // indirect
3835
golang.org/x/tools v0.0.0-20200117065230-39095c1d176c // indirect
3936
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898
4037
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect

‎go.sum

+28-17
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ github.com/dave/rebecca v0.9.1/go.mod h1:N6XYdMD/OKw3lkF3ywh8Z6wPGuwNFDNtWYEMFWE
1313
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
1414
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
1515
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
16+
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
1617
github.com/dlclark/regexp2 v1.2.0 h1:8sAhBGEM0dRWogWqWyQeIJnxjWO6oIjl8FKqREDsGfk=
1718
github.com/dlclark/regexp2 v1.2.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
1819
github.com/dop251/goja v0.0.0-20200526165454-f1752421c432 h1:EIY1hqp9O08saJ41t7aQy0o1hhq3ByOy61AACthST5M=
@@ -54,18 +55,21 @@ github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
5455
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
5556
github.com/labstack/echo v3.3.10+incompatible h1:pGRcYk231ExFAyoAjAfD85kQzRJCRI8bbnE7CX5OEgg=
5657
github.com/labstack/echo v3.3.10+incompatible/go.mod h1:0INS7j/VjnFxD4E2wkz67b8cVwCLbBmJyDaka6Cmk1s=
57-
github.com/labstack/gommon v0.2.9 h1:heVeuAYtevIQVYkGj6A41dtfT91LrvFG220lavpWhrU=
58-
github.com/labstack/gommon v0.2.9/go.mod h1:E8ZTmW9vw5az5/ZyHWCp0Lw4OH2ecsaBP1C/NKavGG4=
58+
github.com/labstack/echo/v4 v4.1.17 h1:PQIBaRplyRy3OjwILGkPg89JRtH2x5bssi59G2EL3fo=
59+
github.com/labstack/echo/v4 v4.1.17/go.mod h1:Tn2yRQL/UclUalpb5rPdXDevbkJ+lp/2svdyFBg6CHQ=
60+
github.com/labstack/gommon v0.3.0 h1:JEeO0bvc78PKdyHxloTKiF8BD5iGrH8T6MSeGvSgob0=
61+
github.com/labstack/gommon v0.3.0/go.mod h1:MULnywXg0yavhxWKc+lOruYdAhDwPK9wf0OL7NoOu+k=
5962
github.com/magiconair/properties v1.8.0 h1:LLgXmsheXeRoUOBOjtwPQCWIYqM/LU1ayDtDePerRcY=
6063
github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
6164
github.com/magiconair/properties v1.8.1 h1:ZC2Vc7/ZFkGmsVC9KvOjumD+G5lXy2RtTKyzRKO2BQ4=
6265
github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
6366
github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
64-
github.com/mattn/go-colorable v0.1.4 h1:snbPLB8fVfU9iwbbo30TPtbLRzwWu6aJS6Xh4eaaviA=
65-
github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
67+
github.com/mattn/go-colorable v0.1.7 h1:bQGKb3vps/j0E9GfJQ03JyhRuxsvdAanXlT9BTw3mdw=
68+
github.com/mattn/go-colorable v0.1.7/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
6669
github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
67-
github.com/mattn/go-isatty v0.0.11 h1:FxPOTFNqGkuDUGi3H/qkUbQO4ZiBa2brKq5r0l8TGeM=
68-
github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
70+
github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
71+
github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
72+
github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
6973
github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
7074
github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
7175
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -121,6 +125,8 @@ github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6Kllzaw
121125
github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
122126
github.com/valyala/fasttemplate v1.0.1 h1:tY9CJiPnMXf1ERmG2EyK7gNUd+c6RKGD0IfU8WdUSz8=
123127
github.com/valyala/fasttemplate v1.0.1/go.mod h1:UQGH1tvbgY+Nz5t2n7tXsz52dQxojPUpymEIMZ47gx8=
128+
github.com/valyala/fasttemplate v1.2.1 h1:TVEnxayobAdVkhQfrfes2IzOB6o+z4roRkPF52WA1u4=
129+
github.com/valyala/fasttemplate v1.2.1/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
124130
github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
125131
golang.org/x/arch v0.0.0-20180920145803-b19384d3c130 h1:Vsc61gop4hfHdzQNolo6Fi/sw7TnJ2yl3ZR4i7bYirs=
126132
golang.org/x/arch v0.0.0-20180920145803-b19384d3c130/go.mod h1:cYlCBUl1MsqxdiKgmc4uh7TxZfWSFLOGSRR090WDxt8=
@@ -131,15 +137,18 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90Pveol
131137
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
132138
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
133139
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
134-
golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37 h1:cg5LA/zNPRzIXIWSCxQW10Rvpy94aQh3LT/ShoCpkHw=
135-
golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
140+
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
141+
golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a h1:vclmkQCjlDX5OydZ9wv8rBCcS0QyQY66Mpf/7BZbInM=
142+
golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
136143
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
137144
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
138145
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
139146
golang.org/x/net v0.0.0-20190620200207-3b0461eec859 h1:R/3boaszxrf1GEUWTVDzSKVwLmSJpwZ1yqXm8j0v2QI=
140147
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
141-
golang.org/x/net v0.0.0-20200513185701-a91f0712d120 h1:EZ3cVSzKOlJxAd8e8YAJ7no8nNypTxexh/YE/xW3ZEY=
142-
golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
148+
golang.org/x/net v0.0.0-20200822124328-c89045814202 h1:VvcQYSHwXgi7W+TpUR6A9g6Up98WAHf3f/ulnJ62IyA=
149+
golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
150+
golang.org/x/net v0.0.0-20200904194848-62affa334b73 h1:MXfv8rhZWmFeqX3GNZRsd6vOLoaCHjYEX3qkRo3YBUA=
151+
golang.org/x/net v0.0.0-20200904194848-62affa334b73/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
143152
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f h1:wMNYb4v58l5UBM7MYRLPG6ZhfOqbKu7X5eyFl8ZhKvA=
144153
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
145154
golang.org/x/sync v0.0.0-20190423024810-112230192c58 h1:8gQV6CLnAEikrhgkHFbMAEhagSSnXWGV915qUMm9mrU=
@@ -152,16 +161,18 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a h1:1BGLXjeY4akVXGgbC9HugT3Jv
152161
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
153162
golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
154163
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
155-
golang.org/x/sys v0.0.0-20190602015325-4c4f7f33c9ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
156-
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037 h1:YyJpGZS1sBuBCzLAR1VEpK193GlqGZbnPFnPV/5Rsb4=
157-
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
164+
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
165+
golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
166+
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
158167
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
159-
golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9 h1:YTzHMGlqJu67/uEo1lBv0n3wBXhXNeUbB1XfN2vmTm0=
160-
golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
168+
golang.org/x/sys v0.0.0-20200826173525-f9321e4c35a6 h1:DvY3Zkh7KabQE/kfzMvYvKirSiguP9Q/veMtkYyf0o8=
169+
golang.org/x/sys v0.0.0-20200826173525-f9321e4c35a6/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
170+
golang.org/x/sys v0.0.0-20200918174421-af09f7315aff h1:1CPUrky56AcgSpxz/KfgzQWzfG09u5YOL8MvPYBlrL8=
171+
golang.org/x/sys v0.0.0-20200918174421-af09f7315aff/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
161172
golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
162173
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
163-
golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
164-
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
174+
golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
175+
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
165176
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
166177
golang.org/x/tools v0.0.0-20181127232545-e782529d0ddd/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
167178
golang.org/x/tools v0.0.0-20200117065230-39095c1d176c h1:FodBYPZKH5tAN2O60HlglMwXGAeV/4k+NKbli79M/2c=

‎internal/rule/callback/shellshock.go

+6-2
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,15 @@ func newShellshockPrologCallback(rule RuleFace, blockingMode bool, regexps []*re
7979
}
8080

8181
for _, env := range env {
82-
v := strings.Split(env, `=`)
83-
if len(v) != 2 {
82+
v := strings.SplitN(env, `=`, 2)
83+
if l := len(v); l <= 0 || l > 2 {
8484
ctx.Logger().Error(sqerrors.Errorf("unexpected number of elements split by `=` in `%s`", env))
8585
return nil, nil
86+
} else if l == 1 {
87+
// Skip empty values
88+
continue
8689
}
90+
8791
name, value := v[0], v[1]
8892
for _, re := range regexps {
8993
if re.MatchString(value) {

‎internal/version/version.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44

55
package version
66

7-
const version = "0.15.0"
7+
const version = "0.16.0"
88

99
func Version() string { return version }

0 commit comments

Comments
 (0)