mirror/go-proton-api
1
0
Fork 0
mirror of https://github.com/ProtonMail/go-proton-api.git synced 2025-12-23 23:57:50 -05:00
Code Issues Packages Projects Releases Wiki Activity

chore: import govulncheck ignore list from bridge repo.

Browse Source
This commit is contained in:
Xavier Michelon
2025-11-27 10:18:32 +01:00
committed by Xavier Michelon
parent a1da1d7a26
commit 9039cd6bf3
1 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
.github/actions/govulncheck.sh vendored
View File

@@ -8,8 +8,21 @@ main(){
jq -r '.finding | select( (.osv != null) and (.trace[0].function != null) ) | .osv ' < vulns.json > vulns_osv_ids.txt jq -r '.finding | select( (.osv != null) and (.trace[0].function != null) ) | .osv ' < vulns.json > vulns_osv_ids.txt
ignore GO-2025-3754 "BRIDGE-388 - github.com/cloudflare/circl indirect import from gopenpgp; wait for upstream to patch" ignore GO-2023-2328 "GODT-3124 RESTY race condition"
ignore GO-2025-3563 "BRIDGE-346 net/http request smuggling"
ignore GO-2025-3754 "BRIDGE-388 github.com/cloudflare/circl indirect import from gopenpgp; need to wait for upstream to patch"
ignore GO-2025-3849 "BRIDGE-416 database/sql race condition leading to potential data overwrite"
ignore GO-2025-3956 "BRIDGE-428 LookPath from os/exec may result in binaries listed in the path to be returned"
ignore GO-2025-4010 "BRIDGE-440 IPv6 parsing"
ignore GO-2025-4007 "BRIDGE-440 non-linear scaling w.r.t cert chain lenght when validating chains"
ignore GO-2025-4009 "BRIDGE-440 non-linear scaling w.r.t parsing PEM inputs"
ignore GO-2025-4015 "BRIDGE-440 Reader.ReadResponse excessive CPU usage"
ignore GO-2025-4008 "BRIDGE-440 ALPN negotiation failure contains attacker controlled information (not-escaped)"
ignore GO-2025-4012 "BRIDGE-440 potentially excessive memory usage on HTTP servers via cookies"
ignore GO-2025-4013 "BRIDGE-440 validating cert chains with DSA public keys may cause programs to panic"
ignore GO-2025-4011 "BRIDGE-440 pasing a maliciously crafted DER payloads could allocate excessive memory"
ignore GO-2025-4014 "BRIDGE-440 tarball extraction may read an unbounded amount of data from the archive into memory"
has_vulns has_vulns
echo echo