title: ÐÐ²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ Ð¿Ð¾Ð¸ÑÐºÐ° ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð°Ñ Ð½Ð° ÑÐ·ÑÐºÐµ Golang
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Automation of vulnerability scanning of Golang programs
Creators: name: Ð Ð°Ð·ÑÐ¼ÐºÐ¾Ð², ÐÐ³Ð¾ÑÑ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2023
Subjects: Ð¿Ð¾Ð¸ÑÐº ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·
vulnerability scanning
static analysis

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸ÑÐµÑÐºÐ¸Ð¹ Ð¿Ð¾Ð¸ÑÐº ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð°Ñ, Ð½Ð°Ð¿Ð¸ÑÐ°Ð½Ð½ÑÑ Ð½Ð° ÑÐ·ÑÐºÐµ Golang. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ Ð¼ÐµÑÐ¾Ð´Ñ Ð¿Ð¾Ð¸ÑÐºÐ° ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð¿Ð¾ÑÐµÐ½ÑÐ¸Ð°Ð»ÑÐ½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð°Ñ Ð½Ð° Golang. 2. ÐÐ½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð¾Ð² Ðº Ð¿Ð¾Ð¸ÑÐºÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹. 3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼ÐµÑÐ¾Ð´Ð° Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð¿Ð¾Ð¸ÑÐºÐ° ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð°Ñ Ð½Ð° Golang. 4. ÐÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð°Ñ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð°. 5. Ð¢ÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð°. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐ¸ Ð² Go Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð°Ñ. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ñ Ðº Ð¿Ð¾Ð¸ÑÐºÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹, Ð° ÑÐ°ÐºÐ¶Ðµ ÐºÐ¾Ð½ÐºÑÐµÑÐ½ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. ÐÑÐ¾Ð¼Ðµ ÑÐ¾Ð³Ð¾, Ð±ÑÐ»Ð¸ Ð¸Ð·ÑÑÐµÐ½Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ ÑÐµÑÐµÐ½Ð¸Ñ, ÑÐµÐ°Ð»Ð¸Ð·ÑÑÑÐ¸Ðµ ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. ÐÑÐ» Ð¿ÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½ ÑÑÐ°Ð²Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð·. ÐÐ° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¿Ð¾Ð»ÑÑÐµÐ½Ð½ÑÑ Ð´Ð°Ð½Ð½ÑÑ Ð±ÑÐ»Ð¾ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð¾ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð¿Ð¾Ð¸ÑÐºÐ° ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Golang Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð°Ñ. ÐÐ°Ð½Ð½Ð¾Ðµ ÑÑÐµÐ´ÑÑÐ²Ð¾ Ð±ÑÐ»Ð¾ Ð¿ÑÐ¾ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¾ Ð½Ð° ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÑ OSS Ð¿ÑÐ¾ÐµÐºÑÐ°Ñ. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ DevSecOps ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°Ð¼Ð¸ Ð´Ð»Ñ Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾Ð³Ð¾ ÑÐ¸ÐºÐ»Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ.
description: The purpose of the work is to automatically search for vulnerabilities in programs written in the Golang language. The subject of the study is vulnerability search methods. The research set the following goals: 1. Investigation of potential vulnerabilities in Golang programs. 2. Analysis of existing approaches to finding vulnerabilities. 3. Development of a method for automatic vulnerability detection in Golang programs. 4. Software implementation of the developed method. 5. Testing of the developed tool. In the course of the work, vulnerabilities in Go programs were investigated. Approaches to vulnerability detection were analyzed, as well as specific methods of static analysis. In addition, existing solutions implementing various methods of static analysis were studied. A comparative analysis was carried out. Based on the data obtained, a tool was developed to automatically search for vulnerabilities in Golang programs. This tool has been tested on various OSS projects. The results obtained can be used by DevSecOps specialists to build a secure software development cycle.