We benchmarked a security detector against 500k lines of Go. It found a real bug.

说明与用途

在50万行Go代码上对安全检测器进行基准测试，发现真实的令牌比较漏洞，证明其在CI中的精确性。

问题

Ensuring that security detectors for Go code correctly identify credential comparison bugs without generating false positives across large codebases.

结果

A precision‑focused detector identified a single real timing side‑channel bug in a large Go codebase, proving that source‑tracking outperforms name‑matching and that zero findings on 430k LOC is a strong indicator of detector quality.

工作流

• 1. Define rule: secrets must be compared with crypto/subtle.ConstantTimeCompare. 2. Implement detector to fire on == comparisons where an operand originates from a credential source (e.g., os.Getenv, r.Header.Get). 3. Exclude test files, vendor code, and resolve helper functions one level deep. 4. Benchmark detector against 8 open‑source Go repos (~503k LOC). 5. Analyze results: 0 findings in 7 repos, 1 real finding in goreleaser. 6. Review finding, confirm it is a timing side‑channel risk. 7. Submit PR to goreleaser to replace == with ConstantTimeCompare. 8. Verify PR acceptance and record outcome.

证据

The detector only fires when an operand has a traceable credential source — a value that came from r.Header.Get(...), os.Getenv(...), or an assignment chained from one of those.

来源

It produced exactly one finding. The finding was real.

来源

The PR is here: https://github.com/goreleaser/goreleaser/pull/6813.

来源