Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address grpc-server-insecure-connection Semgrep error #18

Open
matthieugouel opened this issue Nov 4, 2024 · 0 comments
Open

Address grpc-server-insecure-connection Semgrep error #18

matthieugouel opened this issue Nov 4, 2024 · 0 comments

Comments

@matthieugouel
Copy link
Member

Currently Semgrep CI fails because of the following error:

┌─────────────────────────┐
│ 1 Blocking Code Finding │
└─────────────────────────┘
                          
    pkg/octopus/octopus.go
   ❯❯❱ go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
          Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a
          connection without encryption to this server. A malicious attacker could tamper with the gRPC      
          message, which could compromise the machine. Include credentials derived from an SSL certificate in
          order to create a secure gRPC connection. You can create credentials using                         
          'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'.                                        
          Details: https://sg.run/PwW                                                                        
                                                                                                             
          134┆ s := grpc.NewServer()
    
    
          Taint comes from:
    
          134┆ s := grpc.NewServer()
    
    
                This is how taint reaches the sink:
    
          134┆ s := grpc.NewServer()

We should address this error either by fixing it or ignore it with // nosemgrep: grpc-server-insecure-connection

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant