Gosec (#350)

* Add gosec security scanning GitHub Actions workflow

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

Author: frjcomp

.github/workflows/gosec.yml

@@ -0,0 +1,35 @@
+name: gosec
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  gosec:
+    name: security scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+      - name: Run Gosec Security Scanner
+        uses: securego/gosec@master
+        with:
+          args: '-no-fail -fmt json -out results.json ./src/pipeleak/...'
+      
+      - name: Check Gosec Results
+        run: |
+          FOUND=$(jq '.Stats.found // 0' results.json)
+          echo "Gosec found $FOUND issue(s)"
+          if [ "$FOUND" -gt 0 ]; then
+            echo "❌ Security issues detected! Please fix them before merging."
+            exit 1
+          else
+            echo "✅ No security issues found."
+          fi

.gitignore

@@ -8,3 +8,4 @@ src/pipeleak/pipeleak
 src/pipeleak/pipeleak.exe
 src/pipeleak/coverage.out
 .vscode
+results.json

src/pipeleak/cmd/docs/docs.go

@@ -7,11 +7,13 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"golang.org/x/text/cases"
 	"golang.org/x/text/language"
 	"gopkg.in/yaml.v3"
 
+	"github.com/CompassSecurity/pipeleak/pkg/format"
 	"github.com/rs/zerolog/log"
 	"github.com/spf13/cobra"
 	"github.com/spf13/cobra/doc"
@@ -47,14 +49,15 @@ func generateDocs(cmd *cobra.Command, dir string, level int) error {
 
 	if len(cmd.Commands()) > 0 {
 		dir = filepath.Join(dir, cmd.Name())
-		if err := os.MkdirAll(dir, os.ModePerm); err != nil {
+		if err := os.MkdirAll(dir, format.DirUserGroupRead); err != nil {
 			return err
 		}
 		filename = filepath.Join(dir, "index.md")
 	} else {
 		filename = filepath.Join(dir, getFileName(cmd, level))
 	}
 
+	// #nosec G304 - Creating docs markdown file at controlled internal path during docs generation
 	f, err := os.Create(filename)
 	if err != nil {
 		return err
@@ -164,19 +167,21 @@ func writeMkdocsYaml(rootCmd *cobra.Command, outputDir string) error {
 	nav = append([]map[string]interface{}{introEntry, methodologyEntry}, nav...)
 
 	assetsDir := filepath.Join(outputDir, "pipeleak", "assets")
-	if err := os.MkdirAll(assetsDir, os.ModePerm); err != nil {
+	if err := os.MkdirAll(assetsDir, format.DirUserGroupRead); err != nil {
 		return err
 	}
 
 	assetFiles := []string{"logo.png", "favicon.ico", "social.png"}
 	for _, fname := range assetFiles {
 		src := filepath.Join("..", "..", "docs", fname)
 		dst := filepath.Join(assetsDir, fname)
+		// #nosec G304 - Reading doc assets from controlled internal paths during docs generation
 		data, err := os.ReadFile(src)
 		if err != nil {
 			return err
 		}
-		if err := os.WriteFile(dst, data, 0644); err != nil {
+		// #nosec G306 - Documentation assets should be world-readable
+		if err := os.WriteFile(dst, data, format.FilePublicRead); err != nil {
 			return err
 		}
 	}
@@ -283,7 +288,8 @@ func writeMkdocsYaml(rootCmd *cobra.Command, outputDir string) error {
 	}
 
 	filename := filepath.Join(outputDir, "mkdocs.yml")
-	return os.WriteFile(filename, yamlData, 0644)
+	// #nosec G306 - mkdocs.yml is a public documentation configuration file
+	return os.WriteFile(filename, yamlData, format.FilePublicRead)
 }
 
 var serve bool
@@ -330,7 +336,7 @@ func copyDir(src, dst string) error {
 	if err != nil {
 		return err
 	}
-	if err := os.MkdirAll(dst, os.ModePerm); err != nil {
+	if err := os.MkdirAll(dst, format.DirUserGroupRead); err != nil {
 		return err
 	}
 	for _, entry := range entries {
@@ -350,11 +356,13 @@ func copyDir(src, dst string) error {
 }
 
 func copyFile(src, dst string) error {
+	// #nosec G304 - Copying docs files between controlled internal paths during docs generation
 	in, err := os.Open(src)
 	if err != nil {
 		return err
 	}
 	defer func() { _ = in.Close() }()
+	// #nosec G304 - Creating docs destination file at controlled internal path during docs generation
 	out, err := os.Create(dst)
 	if err != nil {
 		return err
@@ -382,7 +390,7 @@ func Docs(cmd *cobra.Command, args []string) {
 		}
 	}
 
-	if err := os.MkdirAll(outputDir, os.ModePerm); err != nil {
+	if err := os.MkdirAll(outputDir, format.DirUserGroupRead); err != nil {
 		log.Fatal().Err(err).Msg("Failed to create pipeleak directory")
 	}
 
@@ -414,7 +422,15 @@ func Docs(cmd *cobra.Command, args []string) {
 		siteDir := filepath.Join(outputDir, "site")
 		log.Info().Msgf("Serving docs %s at http://localhost:8000 ... (Ctrl+C to quit)", siteDir)
 		http.Handle("/", http.FileServer(http.Dir(siteDir)))
-		if err := http.ListenAndServe(":8000", nil); err != nil {
+
+		server := &http.Server{
+			Addr:         ":8000",
+			ReadTimeout:  15 * time.Second,
+			WriteTimeout: 15 * time.Second,
+			IdleTimeout:  60 * time.Second,
+		}
+
+		if err := server.ListenAndServe(); err != nil {
 			log.Fatal().Err(err).Msg("Failed to start HTTP server")
 		}
 	}

src/pipeleak/cmd/root.go

@@ -13,6 +13,7 @@ import (
 	"github.com/CompassSecurity/pipeleak/cmd/gitea"
 	"github.com/CompassSecurity/pipeleak/cmd/github"
 	"github.com/CompassSecurity/pipeleak/cmd/gitlab"
+	"github.com/CompassSecurity/pipeleak/pkg/format"
 	"github.com/CompassSecurity/pipeleak/pkg/logging"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
@@ -114,10 +115,11 @@ func initLogger(cmd *cobra.Command) {
 	colorEnabled := LogColor
 
 	if LogFile != "" {
+		// #nosec G304 - User-provided log file path via --log-file flag, user controls their own filesystem
 		runLogFile, err := os.OpenFile(
 			LogFile,
 			os.O_APPEND|os.O_CREATE|os.O_WRONLY,
-			0664,
+			format.FileUserReadWrite,
 		)
 		if err != nil {
 			panic(err)
@@ -130,7 +132,6 @@ func initLogger(cmd *cobra.Command) {
 		}
 	}
 
-	// Create the fatal hook to restore terminal state
 	fatalHook := FatalHook{}
 
 	if JsonLogoutput {

src/pipeleak/main.go

@@ -3,7 +3,6 @@ package main
 import (
 	"encoding/json"
 	"io"
-	_ "net/http/pprof"
 	"os"
 
 	"github.com/CompassSecurity/pipeleak/cmd"

src/pipeleak/pkg/format/fileperms.go

@@ -0,0 +1,19 @@
+package format
+
+import "io/fs"
+
+// Common file permission constants used throughout the application.
+// These constants provide named values for file and directory permissions
+// instead of using magic numbers.
+const (
+	// DirUserGroupRead is for directories that should be readable by owner and group (rwxr-x---)
+	DirUserGroupRead fs.FileMode = 0750
+
+	// FilePublicRead is for files that should be world-readable (rw-r--r--)
+	// Used for documentation, assets, and other public files
+	FilePublicRead fs.FileMode = 0644
+
+	// FileUserReadWrite is for files that should only be readable by owner (rw-------)
+	// Used for sensitive files like logs, secrets, and configuration
+	FileUserReadWrite fs.FileMode = 0600
+)

src/pipeleak/pkg/format/string.go

@@ -25,6 +25,7 @@ func RandomStringN(n int) string {
 	letterBytes := "abcdefghijklmnopqrstuvwxyz"
 	b := make([]byte, n)
 	for i := range b {
+		// #nosec G404 - Random string generation for non-security purposes (identifiers, filenames)
 		b[i] = letterBytes[rand.Intn(len(letterBytes))]
 	}
 	return string(b)

src/pipeleak/pkg/gitlab/renovate/enum.go

@@ -447,7 +447,7 @@ func dumpConfigFileContents(project *gitlab.Project, ciCdYml string, renovateCon
 	} else {
 		if len(ciCdYml) > 0 {
 			ciCdPath := filepath.Join(projectDir, "gitlab-ci.yml")
-			if err := os.WriteFile(ciCdPath, []byte(ciCdYml), 0700); err != nil {
+			if err := os.WriteFile(ciCdPath, []byte(ciCdYml), format.FileUserReadWrite); err != nil {
 				log.Error().Err(err).Str("file", ciCdPath).Msg("Failed to write CI/CD YAML to disk")
 			}
 		}
@@ -458,7 +458,7 @@ func dumpConfigFileContents(project *gitlab.Project, ciCdYml string, renovateCon
 				safeFilename = "renovate.json"
 			}
 			configPath := filepath.Join(projectDir, safeFilename)
-			if err := os.WriteFile(configPath, []byte(renovateConfigFile), 0700); err != nil {
+			if err := os.WriteFile(configPath, []byte(renovateConfigFile), format.FileUserReadWrite); err != nil {
 				log.Error().Err(err).Str("file", configPath).Msg("Failed to write Renovate config to disk")
 			}
 		}

src/pipeleak/pkg/gitlab/shodan/shodan.go

@@ -53,6 +53,7 @@ func NewShodanCmd() *cobra.Command {
 
 func Shodan(cmd *cobra.Command, args []string) {
 
+	// #nosec G304 - User-provided file path via CLI flag, user controls their own filesystem
 	jsonFile, err := os.Open(shodanJson)
 	if err != nil {
 		log.Fatal().Stack().Err(err).Msg("failed opening file")

src/pipeleak/pkg/httpclient/client.go

@@ -98,6 +98,7 @@ func GetPipeleakHTTPClient(cookieUrl string, cookies []*http.Cookie, defaultHead
 		return false, nil
 	}
 
+	// #nosec G402 - InsecureSkipVerify required for security scanning tool to connect to untrusted targets
 	tr := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
 
 	proxyServer, useHttpProxy := os.LookupEnv("HTTP_PROXY")