Promote CWE-322 out of experimental status

2026-01-29 14:23:03 +01:00 · 2020-07-28 15:36:38 +01:00
parent 99f08750f3
commit f162a5be94
13 changed files with 3 additions and 1 deletions
--- a/change-notes/2020-07-22-ssh-host-checking.md
+++ b/change-notes/2020-07-22-ssh-host-checking.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Query "Use of insecure HostKeyCallback implementation" (`go/insecure-hostkeycallback`) is promoted from experimental status. This checks for insecurely omitting SSH host-key verification.
--- a/ql/src/experimental/CWE-322/InsecureHostKeyCallback.qhelp
+++ b/ql/src/experimental/CWE-322/InsecureHostKeyCallback.qhelp
--- a/ql/src/experimental/CWE-322/InsecureHostKeyCallback.ql
+++ b/ql/src/experimental/CWE-322/InsecureHostKeyCallback.ql
--- a/ql/src/experimental/CWE-322/InsecureHostKeyCallbackExample.go
+++ b/ql/src/experimental/CWE-322/InsecureHostKeyCallbackExample.go
--- a/ql/src/experimental/CWE-322/SecureHostKeyCallbackExample.go
+++ b/ql/src/experimental/CWE-322/SecureHostKeyCallbackExample.go
--- a/ql/test/experimental/CWE-322/InsecureHostKeyCallback.qlref
+++ b/ql/test/experimental/CWE-322/InsecureHostKeyCallback.qlref
@@ -1 +0,0 @@
-experimental/CWE-322/InsecureHostKeyCallback.ql
--- a/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallback.expected
+++ b/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallback.expected
--- a/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallback.qlref
+++ b/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallback.qlref
@@ -0,0 +1 @@
+Security/CWE-322/InsecureHostKeyCallback.ql
--- a/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallbackExample.go
+++ b/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallbackExample.go
--- a/ql/test/query-tests/Security/CWE-322/go.mod
+++ b/ql/test/query-tests/Security/CWE-322/go.mod
--- a/ql/test/query-tests/Security/CWE-322/vendor/golang.org/LICENSE
+++ b/ql/test/query-tests/Security/CWE-322/vendor/golang.org/LICENSE
--- a/ql/test/query-tests/Security/CWE-322/vendor/golang.org/x/crypto/ssh/stub.go
+++ b/ql/test/query-tests/Security/CWE-322/vendor/golang.org/x/crypto/ssh/stub.go
--- a/ql/test/query-tests/Security/CWE-322/vendor/modules.txt
+++ b/ql/test/query-tests/Security/CWE-322/vendor/modules.txt
				`@@ -1 +0,0 @@`
				`experimental/CWE-322/InsecureHostKeyCallback.ql`
				`@@ -0,0 +1 @@`
				`Security/CWE-322/InsecureHostKeyCallback.ql`