diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..5395ea7 --- /dev/null +++ b/.gitignore @@ -0,0 +1,12 @@ +.DS_Store + +node_modules + +lib/core/metadata.js +lib/core/MetadataBlog.js + +website/translated_docs +website/build/ +website/yarn.lock +website/node_modules +website/i18n/* diff --git a/docs/guidelines.md b/docs/guidelines.md new file mode 100644 index 0000000..b3796e3 --- /dev/null +++ b/docs/guidelines.md @@ -0,0 +1,64 @@ +--- +id: guidelines +title: Secure programming guidelines +--- + +# Secure programming guidelines + + +## Introduction + +Lorem ipsum dolor sit amet, consectetur adipiscing elit. Fusce accumsan porta mauris tristique vulputate. Etiam ac elit eget orci tincidunt scelerisque ac vitae magna. Suspendisse sit amet augue eget metus mollis pretium a sit amet ligula. Nulla interdum suscipit imperdiet. Phasellus consequat nibh in placerat sollicitudin. Etiam felis sapien, facilisis nec elit eget, vestibulum aliquet tortor. Nulla in nibh faucibus, congue ligula vitae, aliquam augue. + +Praesent a lacus et turpis lacinia fringilla sed ac dui. Praesent sed enim lorem. Integer id rutrum leo, et cursus turpis. Pellentesque non tortor imperdiet, consequat ante eget, venenatis lacus. Cras lobortis eros ac risus lacinia euismod ut sed ante. Ut rutrum nisl eget risus malesuada dapibus. Curabitur vel molestie felis. Proin ut velit id nibh vehicula tristique. Quisque auctor aliquam nulla at tempus. + +Sed et accumsan augue. Donec sagittis non arcu quis iaculis. Proin quam augue, fermentum quis nibh id, vulputate imperdiet lacus. Duis dictum, lectus eu pulvinar fermentum, sem quam gravida sem, ac viverra diam erat vel augue. Curabitur pretium sodales imperdiet. Morbi sodales ut est vitae rutrum. Duis molestie sit amet nisi non accumsan. Etiam ultricies malesuada orci. Proin dictum non nisi eget sagittis. Nunc sit amet elementum urna, nec euismod diam. Donec ullamcorper cursus nisi, nec tristique metus. Mauris ullamcorper malesuada ultrices. In a fringilla est. Praesent efficitur feugiat ipsum, eget luctus leo pharetra quis. + + +## General guidence + +### G101: Hardcoded credentials +### G102: Network interfaces +### G103: Use of unsafe block +### G104: Unchecked errors +### G105: Pitfalls of math/big.Int.Exp + +## Avoiding injection vulnerabilities + +### G201: SQL query construction using format string +### G202: SQL query construction using string concatenation +### G203: Use of unescaped data in HTML templates +### G204: Command execution + +## Using the file system securely + +### G301: Poor file permissions used when creating a directory +### G302: Poor file permisions used with chmod +### G303: Creating tempfile using a predictable path +### G304: File path provided as taint input +### G305: File traversal when extracting zip archive + +## Cryptography + +### G401 - Cryptography primitives +### G402 - TLS connection settings +### G403 - RSA Key Length +### G404 - Random number sources + +## Web topics + +Look at providing recommendations around common web frameworks for Go (some +may translate into rules). + +Some example topics: +* xss +* xsrf +* ssrf +* session uniqueness / encryption vs signatures +* sessions fixation +* security headers +* unvalidated redirects, +* net/cgi +* jwt pitfalls +* rate limiting +* password strength and lockouts diff --git a/docs/tools.md b/docs/tools.md new file mode 100644 index 0000000..321504c --- /dev/null +++ b/docs/tools.md @@ -0,0 +1,12 @@ +--- +id: tools +title: Recommended Security Tools +--- + +# [github.com/securego/gosec](https://github.com/securego/gosec) + +The gosec project is attempts to programmatically enforce the secure go +guidelines. + +* TODO - Usage and tuning information? +* TODO - Table of guidelines -> gosec rule ID diff --git a/website/blog/2018-08-08-hello-world.md b/website/blog/2018-08-08-hello-world.md new file mode 100755 index 0000000..37a7f16 --- /dev/null +++ b/website/blog/2018-08-08-hello-world.md @@ -0,0 +1,17 @@ +--- +title: Hello World +author: Grant Murphy +authorURL: http://twitter.com/u1f612 +--- + +Lorem ipsum dolor sit amet, consectetur adipiscing elit. Pellentesque elementum dignissim ultricies. Fusce rhoncus ipsum tempor eros aliquam consequat. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vivamus elementum massa eget nulla aliquet sagittis. Proin odio tortor, vulputate ut odio in, ultrices ultricies augue. Cras ornare ultrices lorem malesuada iaculis. Etiam sit amet libero tempor, pulvinar mauris sed, sollicitudin sapien. + + + +Mauris vestibulum ullamcorper nibh, ut semper purus pulvinar ut. Donec volutpat orci sit amet mauris malesuada, non pulvinar augue aliquam. Vestibulum ultricies at urna ut suscipit. Morbi iaculis, erat at imperdiet semper, ipsum nulla sodales erat, eget tincidunt justo dui quis justo. Pellentesque dictum bibendum diam at aliquet. Sed pulvinar, dolor quis finibus ornare, eros odio facilisis erat, eu rhoncus nunc dui sed ex. Nunc gravida dui massa, sed ornare arcu tincidunt sit amet. Maecenas efficitur sapien neque, a laoreet libero feugiat ut. + +Nulla facilisi. Maecenas sodales nec purus eget posuere. Sed sapien quam, pretium a risus in, porttitor dapibus erat. Sed sit amet fringilla ipsum, eget iaculis augue. Integer sollicitudin tortor quis ultricies aliquam. Suspendisse fringilla nunc in tellus cursus, at placerat tellus scelerisque. Sed tempus elit a sollicitudin rhoncus. Nulla facilisi. Morbi nec dolor dolor. Orci varius natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Cras et aliquet lectus. Pellentesque sit amet eros nisi. Quisque ac sapien in sapien congue accumsan. Nullam in posuere ante. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; Proin lacinia leo a nibh fringilla pharetra. + +Orci varius natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Proin venenatis lectus dui, vel ultrices ante bibendum hendrerit. Aenean egestas feugiat dui id hendrerit. Orci varius natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Curabitur in tellus laoreet, eleifend nunc id, viverra leo. Proin vulputate non dolor vel vulputate. Curabitur pretium lobortis felis, sit amet finibus lorem suscipit ut. Sed non mollis risus. Duis sagittis, mi in euismod tincidunt, nunc mauris vestibulum urna, at euismod est elit quis erat. Phasellus accumsan vitae neque eu placerat. In elementum arcu nec tellus imperdiet, eget maximus nulla sodales. Curabitur eu sapien eget nisl sodales fermentum. + +Phasellus pulvinar ex id commodo imperdiet. Praesent odio nibh, sollicitudin sit amet faucibus id, placerat at metus. Donec vitae eros vitae tortor hendrerit finibus. Interdum et malesuada fames ac ante ipsum primis in faucibus. Quisque vitae purus dolor. Duis suscipit ac nulla et finibus. Phasellus ac sem sed dui dictum gravida. Phasellus eleifend vestibulum facilisis. Integer pharetra nec enim vitae mattis. Duis auctor, lectus quis condimentum bibendum, nunc dolor aliquam massa, id bibendum orci velit quis magna. Ut volutpat nulla nunc, sed interdum magna condimentum non. Sed urna metus, scelerisque vitae consectetur a, feugiat quis magna. Donec dignissim ornare nisl, eget tempor risus malesuada quis. diff --git a/website/core/Footer.js b/website/core/Footer.js new file mode 100644 index 0000000..f8cbff6 --- /dev/null +++ b/website/core/Footer.js @@ -0,0 +1,90 @@ +/** + * Copyright (c) 2017-present, Facebook, Inc. + * + * This source code is licensed under the MIT license found in the + * LICENSE file in the root directory of this source tree. + */ + +const React = require('react'); + +class Footer extends React.Component { + docUrl(doc, language) { + const baseUrl = this.props.config.baseUrl; + return baseUrl + 'docs/' + (language ? language + '/' : '') + doc; + } + + pageUrl(doc, language) { + const baseUrl = this.props.config.baseUrl; + return baseUrl + (language ? language + '/' : '') + doc; + } + + render() { + const currentYear = new Date().getFullYear(); + return ( + + ); + } +} + +module.exports = Footer; diff --git a/website/package.json b/website/package.json new file mode 100644 index 0000000..8789f2c --- /dev/null +++ b/website/package.json @@ -0,0 +1,19 @@ +{ + "license": "Apache-2.0", + "scripts": { + "examples": "docusaurus-examples", + "start": "docusaurus-start", + "build": "docusaurus-build", + "publish-gh-pages": "docusaurus-publish", + "write-translations": "docusaurus-write-translations", + "version": "docusaurus-version", + "rename-version": "docusaurus-rename-version" + }, + "devDependencies": { + "docusaurus": "^1.3.2" + }, + "dependencies": { + "i": "^0.3.6", + "npm": "^6.3.0" + } +} diff --git a/website/pages/en/help.js b/website/pages/en/help.js new file mode 100755 index 0000000..215a8a2 --- /dev/null +++ b/website/pages/en/help.js @@ -0,0 +1,63 @@ +/** + * Copyright (c) 2017-present, Facebook, Inc. + * + * This source code is licensed under the MIT license found in the + * LICENSE file in the root directory of this source tree. + */ + +const React = require('react'); + +const CompLibrary = require('../../core/CompLibrary.js'); +const Container = CompLibrary.Container; +const GridBlock = CompLibrary.GridBlock; + +const siteConfig = require(process.cwd() + '/siteConfig.js'); + +function docUrl(doc, language) { + return siteConfig.baseUrl + 'docs/' + (language ? language + '/' : '') + doc; +} + +function pageUrl(page, language) { + return siteConfig.baseUrl + (language ? language + '/' : '') + page; +} + +class Help extends React.Component { + render() { + let language = this.props.language || ''; + const supportLinks = [ + { + content: `Learn more using the [guidelines on this site.](${docUrl( + 'guidelines.html', + language + )})`, + title: 'Browse Docs', + }, + { + content: 'Ask us questions on [Slack](http://securego.herokuapp.com/).', + title: 'Join the community', + }, + { + content: `Find out what's new with this project by reading [our blog](${pageUrl('blog')}).`, + title: 'Stay up to date', + }, + ]; + + return ( +
+ +
+
+

Need help?

+
+

This project is maintained by a handful of dedicated people. Feel free to + reach out with questions! +

+ +
+ +
+ ); + } +} + +module.exports = Help; diff --git a/website/pages/en/index.js b/website/pages/en/index.js new file mode 100755 index 0000000..cd6fb1f --- /dev/null +++ b/website/pages/en/index.js @@ -0,0 +1,221 @@ +/** + * Copyright (c) 2017-present, Facebook, Inc. + * + * This source code is licensed under the MIT license found in the + * LICENSE file in the root directory of this source tree. + */ + +const React = require('react'); +const CompLibrary = require('../../core/CompLibrary.js'); +const MarkdownBlock = CompLibrary.MarkdownBlock; /* Used to read markdown */ +const Container = CompLibrary.Container; +const GridBlock = CompLibrary.GridBlock; + +const siteConfig = require(process.cwd() + '/siteConfig.js'); + +function imgUrl(img) { + return siteConfig.baseUrl + 'img/' + img; +} + +function docUrl(doc, language) { + return siteConfig.baseUrl + 'docs/' + (language ? language + '/' : '') + doc; +} + +function pageUrl(page, language) { + return siteConfig.baseUrl + (language ? language + '/' : '') + page; +} + +class Button extends React.Component { + render() { + return ( +
+ + {this.props.children} + +
+ ); + } +} + +Button.defaultProps = { + target: '_self', +}; + +const SplashContainer = props => ( +
+
+
{props.children}
+
+
+); + +const Logo = props => ( +
+ +
+); + +const ProjectTitle = props => ( +

+ {siteConfig.title} + {siteConfig.tagline} +

+); + +const PromoSection = props => ( +
+
+
{props.children}
+
+
+); + +class HomeSplash extends React.Component { + render() { + let language = this.props.language || ''; + return ( + + +
+ + + + + + +
+ + ); + } +} + +const Block = props => ( + + + +); + +const Features = props => ( + + {[ + { + content: 'This is the content of my feature', + image: imgUrl('docusaurus.svg'), + imageAlign: 'top', + title: 'Feature One', + }, + { + content: 'The content of my second feature', + image: imgUrl('docusaurus.svg'), + imageAlign: 'top', + title: 'Feature Two', + }, + ]} + +); + +const FeatureCallout = props => ( +
+

Feature Callout

+ These are features of this project +
+); + +/* +const LearnHow = props => ( + + {[ + { + content: 'Talk about learning how to use this', + image: imgUrl('docusaurus.svg'), + imageAlign: 'right', + title: 'Learn How', + }, + ]} + +); +*/ + +const TryOut = props => ( + + {[ + { + content: 'Talk about trying this out', + image: imgUrl('docusaurus.svg'), + imageAlign: 'left', + title: 'Try it Out', + }, + ]} + +); + +const Description = props => ( + + {[ + { + content: 'This is another description of how this project is useful', + image: imgUrl('docusaurus.svg'), + imageAlign: 'right', + title: 'Description', + }, + ]} + +); + +const Showcase = props => { + if ((siteConfig.users || []).length === 0) { + return null; + } + const showcase = siteConfig.users + .filter(user => { + return user.pinned; + }) + .map((user, i) => { + return ( + + {user.caption} + + ); + }); + + return ( +
+

{"Who's Using This?"}

+

This project is used by all these people

+
{showcase}
+
+ + More {siteConfig.title} Users + +
+
+ ); +}; + +class Index extends React.Component { + render() { + let language = this.props.language || ''; + + return ( +
+ +
+ {/* + + + + + + */} +
+
+ ); + } +} + +module.exports = Index; diff --git a/website/pages/en/users.js b/website/pages/en/users.js new file mode 100644 index 0000000..c113bf5 --- /dev/null +++ b/website/pages/en/users.js @@ -0,0 +1,49 @@ +/** + * Copyright (c) 2017-present, Facebook, Inc. + * + * This source code is licensed under the MIT license found in the + * LICENSE file in the root directory of this source tree. + */ + +const React = require('react'); + +const CompLibrary = require('../../core/CompLibrary.js'); +const Container = CompLibrary.Container; + +const siteConfig = require(process.cwd() + '/siteConfig.js'); + +class Users extends React.Component { + render() { + if ((siteConfig.users || []).length === 0) { + return null; + } + const editUrl = siteConfig.repoUrl + '/edit/master/website/siteConfig.js'; + const showcase = siteConfig.users.map((user, i) => { + return ( + + {user.caption} + + ); + }); + + return ( +
+ +
+
+

Who's Using This?

+

This project is used by many folks

+
+
{showcase}
+

Are you using this project?

+ + Add your company + +
+ +
+ ); + } +} + +module.exports = Users; diff --git a/website/sidebars.json b/website/sidebars.json new file mode 100644 index 0000000..512bbb4 --- /dev/null +++ b/website/sidebars.json @@ -0,0 +1,4 @@ +{ + "docs": { + } +} diff --git a/website/siteConfig.js b/website/siteConfig.js new file mode 100644 index 0000000..da8378d --- /dev/null +++ b/website/siteConfig.js @@ -0,0 +1,100 @@ +/** + * Copyright (c) 2017-present, Facebook, Inc. + * + * This source code is licensed under the MIT license found in the + * LICENSE file in the root directory of this source tree. + */ + +// See https://docusaurus.io/docs/site-config.html for all the possible +// site configuration options. + +/* List of projects/orgs using your project for the users page +const users = [ + { + caption: 'User1', + // You will need to prepend the image path with your baseUrl + // if it is not '/', like: '/test-site/img/docusaurus.svg'. + image: '/img/docusaurus.svg', + infoLink: 'https://www.facebook.com', + pinned: true, + }, +]; +*/ + +const siteConfig = { + title: 'Secure Go' /* title for your website */, + tagline: 'A project devoted to secure programming in the Go language', + url: 'https://securego.io' /* your website url */, + baseUrl: '/' /* base url for your project */, + // For github.io type URLs, you would set the url and baseUrl like: + // url: 'https://facebook.github.io', + // baseUrl: '/test-site/', + + // Used for publishing and more + //projectName: 'gosec', + //organizationName: 'securego', + // For top-level user or org sites, the organization is still the same. + // e.g., for the https://JoelMarcey.github.io site, it would be set like... + organizationName: 'securego', + + // For no header links in the top nav bar -> headerLinks: [], + headerLinks: [ + {doc: 'guidelines', label: 'Guidelines'}, + {doc: 'tools', label: 'Tools'}, + {page: 'help', label: 'Help'}, + {blog: true, label: 'Blog'}, + ], + + // If you have users set above, you add it here: + //users, + + /* path to images for header/footer */ + headerIcon: 'img/gosec.svg', + footerIcon: 'img/gosec.svg', + favicon: 'img/favicon.png', + + /* colors for website */ + colors: { + primaryColor: '#4f769b', + secondaryColor: '#a2e2e5', + }, + + /* custom fonts for website */ + /*fonts: { + myFont: [ + "Times New Roman", + "Serif" + ], + myOtherFont: [ + "-apple-system", + "system-ui" + ] + },*/ + + // This copyright info is used in /core/Footer.js and blog rss/atom feeds. + copyright: + 'Copyright © ' + + new Date().getFullYear() + + ' Grant Murphy', + + highlight: { + // Highlight.js theme to use for syntax highlighting in code blocks + theme: 'default', + }, + + // Add custom scripts here that would be placed in