Using AI to Normalize and Improve Scan Rule Documentation at Codacy

GoSec (Golang)

G101

Look for hardcoded credentials

(No explanation)

Avoid Hardcoded Credentials

Detects hardcoded credentials in the code.

Why is this a problem?

Hardcoded credentials can lead to security vulnerabilities as they may be exposed in source code repositories or logs, allowing unauthorized access to systems.

How do you fix it?

Remove hardcoded credentials from the code and use secure methods such as environment variables, configuration files with proper access controls, or secret management tools to handle sensitive information.

Pylint (Python)

not-in-loop (E0103)

%r not properly in loop Used when break or continue keywords are used outside a loop.

Explanation

%r not properly in loop Used when break or continue keywords are used outside a loop.

Avoid using break or continue outside loops

Detects usage of break or continue statements outside of loops.

Why is this a problem?

Using break or continue outside of a loop causes a syntax error and indicates a logical mistake in the code structure.

How do you fix it?

Ensure that break or continue statements are only used inside loops such as for or while loops.

Revive (Golang)

time-equal

This rule warns when using == and != for equality check time.Time and suggest to time.time.Equal method, for about information follow this link

Explanation

Description: This rule warns when using == and != for equality check time.Time and suggest to time.time.Equal method, for about information follow this link

Configuration: N/A

Enforce time.Time Equality Using Equal Method

Warns when using == or != operators to compare time.Time values and suggests using the time.Time.Equal method instead.

Why is this a problem?

Using == or != operators to compare time.Time values can lead to incorrect results because these operators compare the entire struct including unexported fields, which may not reflect actual time equality. The time.Time.Equal method correctly compares the time instant represented by the values.

How do you fix it?

Replace any usage of == or != operators for comparing time.Time values with the time.Time.Equal method to ensure correct equality checks.

Good Examples

t1.Equal(t2)

!t1.Equal(t2)

Bad Examples

t1 == t2

t1 != t2

Cppcheck (C/C++)

Array index 'i' is used before limits check.

Defensive programming: The variable 'i' is used as an array index before it is checked that is within limits. This can mean that the array might be accessed out of bounds. Reorder conditions such as '(a[i] && i < 10)' to '(i < 10 && a[i])'. That way the array will not be accessed if the index is out of limits.

(No explanation)

Avoid Using Array Index Before Limits Check

Detects when an array index variable is used before confirming it is within valid bounds, which can lead to out-of-bounds array access.

Why is this a problem?
Using an array index before verifying it is within the array limits can cause undefined behavior, including crashes or data corruption, due to out-of-bounds access.

How do you fix it?
Ensure that any array index is checked against the array limits before using it to access the array. For example, reorder conditions to check the index first before accessing the array element.

Good Examples
if (i < 10 && a[i]) { /* safe access */ }

Bad Examples
if (a[i] && i < 10) { /* unsafe access */ C}

Semgrep (22 languages)

unsafe-path-combine

String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName.

Explanation

String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal.

Avoid Unsafe Path.Combine Usage Without Sanitization

Detects usage of Path.Combine with string arguments that are not sanitized via Path.GetFileName, which can lead to path traversal vulnerabilities.

Why is this a problem?

Using Path.Combine with unsanitized user-supplied input can allow attackers to perform path traversal attacks, potentially accessing or modifying unauthorized files on the filesystem.

How do you fix it?

Ensure that any string arguments used in Path.Combine are properly sanitized using Path.GetFileName or equivalent methods before combining paths to prevent path traversal.

Good Examples

var safeFileName = Path.GetFileName(userInput);
var fullPath = Path.Combine(basePath, safeFileName);

Bad Examples

var fullPath = Path.Combine(basePath, userInput);

Checkov
(infrastructure-as-code)

Ensure that SSL validation isn't disabled with dnf

Explanation

More information [here].

Ensure SSL Validation Is Not Disabled with dnf

Checks that SSL validation is enabled when using dnf to avoid insecure package downloads.

Why is this a problem?
Disabling SSL validation can expose the system to man-in-the-middle attacks, allowing attackers to intercept or tamper with package downloads, leading to potential compromise or installation of malicious software.

How do you fix it?
Configure dnf to keep SSL validation enabled by not setting sslverify to false or any equivalent disabling option in the configuration or command usage.

Good Examples

- name: Install packages securely
ansible.builtin.dnf:
name: httpd
state: present
sslverify: yes

Bad Examples

- name: Install packages insecurely
ansible.builtin.dnf:
name: httpd
state: present
sslverify: no

Checkov (Infra-as-code)

Ensure terraform is not sending SSM secrets to untrusted domains over HTTP

Severity: Medium ⚠️
Category: Error Prone 🐞

Ensure Terraform Does Not Send SSM Secrets to Untrusted Domains Over HTTP

Severity: Critical 🛑
Category: Security 🔒