Skip to content

Address grpc-server-insecure-connection Semgrep error #18

Description

@matthieugouel

Currently Semgrep CI fails because of the following error:

┌─────────────────────────┐
│ 1 Blocking Code Finding │
└─────────────────────────┘
                          
    pkg/octopus/octopus.go
   ❯❯❱ go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
          Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a
          connection without encryption to this server. A malicious attacker could tamper with the gRPC      
          message, which could compromise the machine. Include credentials derived from an SSL certificate in
          order to create a secure gRPC connection. You can create credentials using                         
          'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'.                                        
          Details: https://sg.run/PwW                                                                        
                                                                                                             
          134┆ s := grpc.NewServer()
    
    
          Taint comes from:
    
          134┆ s := grpc.NewServer()
    
    
                This is how taint reaches the sink:
    
          134┆ s := grpc.NewServer()

We should address this error either by fixing it or ignore it with // nosemgrep: grpc-server-insecure-connection

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions