How to get started and use Gosec

This article analyzes "how to get started and use Gosec". The content is detailed and easy to understand. Friends interested in "how to get started and use Gosec" can read it slowly and deeply along with the ideas of Xiaobian. I hope it can help everyone after reading. Let's learn more about "How to get started and use Gosec" together with Xiaobian.

Statement:

This tutorial is to test the effect of Gosec locally on your computer, so it does not involve other running modes. If you want to understand other modes, you can pay attention to the later documents. If you want to customize the custom code scanning rules, you can communicate with me.

Use Tutorial Requirements

Go's development environment has been configured

Prepare a test project code

Step 1. Go to src directory of Go environment

Go to github.com/securego/gosec/v2/cmd/gosec

2. Direct Build

Go to gosec project directory: cd ./ gosec/, re-execute: make

Tip: After make, you can use gosec to scan the code, and it is a global command.

3. scan code

Go to the directory of code you have prepared and execute: gosec -fmt=json ./... Check all the code in the current directory and output it to the terminal in Json format.

Then check the results. If there are loopholes, they will be clearly written in the Json data format and the danger level will be clearly written.

Gosec Common Command 1. Output content directly to the terminal

gosec -fmt=json ./... Supported formats: text, json, yaml, csv, sonarqube, JUnit XML, html

2. Output to specified file

gosec -fmt=json -out=results.json ./... Output format should match file suffix name

3. Specify rules to use #Specify rules to use

$ gosec -include=G101,G203,G401 ./...

#Use default all rules except a few

$ gosec -exclude=G303 ./... How to get started and use Gosec is shared here. I hope the above content can improve everyone. If you want to learn more, please pay more attention to the updates of Xiaobian. Thank you for your attention to the website!