OWASP Dependency Check for Go

[dgt-amexio]

Hello,

We are leveraging the OWASP DependencyCheck utility (through its maven plugin) to detect vulnerabilities in our project's dependencies and sucessfully covered Java & Node related code.

As we plan to leverage Go language for additional components/modules, we are looking at a convenient way to extend the vulnerability analysis on such modules. Our first attempt consisted in leveraging experimental Golang analyzer that proves introducing a significant amounf of false positives/negatives.

On the other hand we saw that the Go ecosystem comes with a tailored solution (see https://go.dev/doc/security/vuln) which relies on a curated database aimed at avoiding such false positives/negatives.

Do you have any plans to integrate with the Go based analysis in the future (eg : something similar to Node Audit Analyzer that relies on node ecosystem to collect vulerabilities.

Kind regards

[chadlwilson]

I don't think there is a plan, but the project does accept PRs.

What would the value of using ODC be if it were to do so? Consolidated reports and suppression rules?

[chadlwilson]

There are actually two golang analyzers (neither of which are immune to FPs with static compiles in golang) - which one did you try?

[dgt-amexio]

Hello Chad,

We tried and tested the Golang Mod Analyzer because the context in which we'll invove Go development relies on modules.
(Nevertheless from what I understood, seems that both analyzers would be impacted by false positives/false negatives)

As you identified, expected added value of such an enrichment of ODC would consist in consolidating reports (and suppression rules as well, if needed)

Kind regards

[chadlwilson]

I suspect it would require someone from the community to do the analysis of whether this is possible and pick this up.

I imagine it’d require

• a way to detect which files are go binaries (non-trivial since binaries have no particular extension, and you cannot check every single file - maybe have to look for executable bit or .exe?)
• to decide on which output format to use (json, sarif, openvex)
• to write a parser for that output to translate to ODC format
• to figure out how to de-duplicate with vulnerabilities with the same ids from other data sources (since it aggregates data)
• to figure out how to report the vulnerabilities consistently since ODC reports against the actual dependency, not the things that consume them like an executable