2026-04-06 15:48:37 +05:30
|
|
|
# Copyright IBM Corp. 2020, 2026
|
2026-01-30 11:17:07 +05:30
|
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
|
|
|
|
|
|
rules:
|
|
|
|
|
- id: avoid-crypto-rand-use-secure-reader
|
|
|
|
|
languages:
|
|
|
|
|
- go
|
|
|
|
|
severity: WARNING
|
|
|
|
|
message: |
|
|
|
|
|
The 'crypto/rand' package is being used directly.
|
|
|
|
|
To ensure consistent security patterns across our codebase,
|
|
|
|
|
please use 'SecureRandomReader' instead.
|
|
|
|
|
patterns:
|
|
|
|
|
- pattern: |
|
|
|
|
|
rand.Reader
|
|
|
|
|
- pattern-inside: |
|
|
|
|
|
import "crypto/rand"
|
|
|
|
|
...
|
|
|
|
|
paths:
|
|
|
|
|
exclude:
|
|
|
|
|
- "*_test.go"
|
|
|
|
|
- "**/website/*"
|
|
|
|
|
- "**/testing/*"
|
|
|
|
|
- "options.go"
|
|
|
|
|
- "testing.go"
|
|
|
|
|
- "controller.go"
|
|
|
|
|
- "servers.go"
|
|
|
|
|
- "worker.go"
|
|
|
|
|
- "repository_scope.go"
|
|
|
|
|
- "keys.go"
|
|
|
|
|
- "testing_ent.go"
|
|
|
|
|
- "options_ent.go"
|
|
|
|
|
fix: Use SecureRandomReader instead of crypto/rand.Reader directly.
|
