results.sarif

{
	"runs": [
		{
			"results": [
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "internal/providers/pkcs11.go"
								},
								"region": {
									"endColumn": 27,
									"endLine": 70,
									"snippet": {
										"text": "cipherText := s.aead.Seal(result[nonceSize:nonceSize], result[:nonceSize], plaintext, []byte(s.keyID))"
									},
									"sourceLanguage": "go",
									"startColumn": 27,
									"startLine": 70
								}
							}
						}
					],
					"message": {
						"text": "Use of hardcoded IV/nonce for encryption by passing hardcoded slice/array"
					},
					"ruleId": "G407"
				},
				{
					"level": "error",
					"locations": [
						{
							"physicalLocation": {
								"artifactLocation": {
									"uri": "internal/providers/hvault.go"
								},
								"region": {
									"endColumn": 14,
									"endLine": 42,
									"snippet": {
										"text": "ctx, err := os.ReadFile(configFilePath)"
									},
									"sourceLanguage": "go",
									"startColumn": 14,
									"startLine": 42
								}
							}
						}
					],
					"message": {
						"text": "Potential file inclusion via variable"
					},
					"ruleId": "G304"
				}
			],
			"taxonomies": [
				{
					"downloadUri": "https://cwe.mitre.org/data/xml/cwec_v4.4.xml.zip",
					"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
					"informationUri": "https://cwe.mitre.org/data/published/cwe_v4.4.pdf/",
					"isComprehensive": true,
					"language": "en",
					"minimumRequiredLocalizedDataSemanticVersion": "4.4",
					"name": "CWE",
					"organization": "MITRE",
					"releaseDateUtc": "2021-03-15",
					"shortDescription": {
						"text": "The MITRE Common Weakness Enumeration"
					},
					"taxa": [
						{
							"fullDescription": {
								"text": "The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive."
							},
							"guid": "34372d11-a1a4-32a4-8763-67c530128d42",
							"helpUri": "https://cwe.mitre.org/data/definitions/1204.html",
							"id": "1204",
							"shortDescription": {
								"text": "Generation of Weak Initialization Vector (IV)"
							}
						},
						{
							"fullDescription": {
								"text": "The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory."
							},
							"guid": "3e718404-88bc-3f17-883e-e85e74078a76",
							"helpUri": "https://cwe.mitre.org/data/definitions/22.html",
							"id": "22",
							"shortDescription": {
								"text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
							}
						}
					],
					"version": "4.4"
				}
			],
			"tool": {
				"driver": {
					"guid": "8b518d5f-906d-39f9-894b-d327b1a421c5",
					"informationUri": "https://github.com/securego/gosec/",
					"name": "gosec",
					"rules": [
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Potential file inclusion via variable"
							},
							"help": {
								"text": "Potential file inclusion via variable\nSeverity: MEDIUM\nConfidence: HIGH\n"
							},
							"id": "G304",
							"name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"MEDIUM"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "3e718404-88bc-3f17-883e-e85e74078a76",
										"id": "22",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Potential file inclusion via variable"
							}
						},
						{
							"defaultConfiguration": {
								"level": "error"
							},
							"fullDescription": {
								"text": "Use of hardcoded IV/nonce for encryption by passing hardcoded slice/array"
							},
							"help": {
								"text": "Use of hardcoded IV/nonce for encryption by passing hardcoded slice/array\nSeverity: HIGH\nConfidence: HIGH\n"
							},
							"id": "G407",
							"name": "Generation of Weak Initialization Vector (IV)",
							"properties": {
								"precision": "high",
								"tags": [
									"security",
									"HIGH"
								]
							},
							"relationships": [
								{
									"kinds": [
										"superset"
									],
									"target": {
										"guid": "34372d11-a1a4-32a4-8763-67c530128d42",
										"id": "1204",
										"toolComponent": {
											"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
											"name": "CWE"
										}
									}
								}
							],
							"shortDescription": {
								"text": "Use of hardcoded IV/nonce for encryption by passing hardcoded slice/array"
							}
						}
					],
					"semanticVersion": "2.22.1",
					"supportedTaxonomies": [
						{
							"guid": "f2856fc0-85b7-373f-83e7-6f8582243547",
							"name": "CWE"
						}
					],
					"version": "2.22.1"
				}
			}
		}
	],
	"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
	"version": "2.1.0"
}