vault/tools/semgrep/ci/logger-format-string.yml
Vault Automation 0c6c13dd38
license: update headers to IBM Corp. (#10229) (#10233)
* license: update headers to IBM Corp.
* `make proto`
* update offset because source file changed

Signed-off-by: Ryan Cragun <me@ryan.ec>
Co-authored-by: Ryan Cragun <me@ryan.ec>
2025-10-21 15:20:20 -06:00

25 lines
No EOL
793 B
YAML

# Copyright IBM Corp. 2016, 2025
# SPDX-License-Identifier: BUSL-1.1
rules:
- id: logger-used-with-format-string
patterns:
- pattern-either:
- pattern: |
$LOGGER.Trace("=~/.*%[v#T%tbcdoOqxXUbeEfFgGps].*/",...)
- pattern: |
$LOGGER.Debug("=~/.*%[v#T%tbcdoOqxXUbeEfFgGps].*/",...)
- pattern: |
$LOGGER.Info("=~/.*%[v#T%tbcdoOqxXUbeEfFgGps].*/",...)
- pattern: |
$LOGGER.Warn("=~/.*%[v#T%tbcdoOqxXUbeEfFgGps].*/",...)
- pattern: |
$LOGGER.Error("=~/.*%[v#T%tbcdoOqxXUbeEfFgGps].*/",...)
- pattern-inside: |
import $LOG "github.com/hashicorp/go-hclog"
...
message: "Logger message looks like format string"
languages: [go]
severity: ERROR