Add new rule G407 to detect hard-coded nonce and initialization vectors in crypto algorithms

[expp121]

This rule looks for hard-coded nonce/ initialization vectors or variables which have hard-coded nonces/IV, that are given to multiple encryption algorithms such as: AES CBC,CTR,OFB,CFB,ASCON,CHACHA20

The rule has the following features:

• Ability to track hard-coded args passed directly to the function
• Ability to track variables which are assigned to hard-coded values
• Ability to track when a variable is assigned to the result of a function, it will go and inspect the function whether it has a call to cipher/rand.Read and flag it as vulnerable if it doesn't
• Ability to backtrack when the encryption algorithm is in another fucntion (example func cool(){ cipher.NewCTR(bloc,nonce)}

closes #1196

[ccojocar]

@expp121 there are some lint errors, please could you have a look https://github.com/securego/gosec/actions/runs/10630482755/job/29469424412?pr=1197?

[expp121]

@expp121 there are some lint errors, please could you have a look https://github.com/securego/gosec/actions/runs/10630482755/job/29469424412?pr=1197?

Yep, I was about to fix them! Thank you for pointing that out!

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

Attention: Patch coverage is 82.44275% with 23 lines in your changes missing coverage. Please review.

Project coverage is 67.82%. Comparing base (4ae73c8) to head (d9eaa05).

Files with missing lines	Patch %	Lines
analyzers/hardcodedNonce.go	85.71%	9 Missing and 9 partials ⚠️
analyzers/util.go	0.00%	5 Missing ⚠️

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1197      +/-   ##
==========================================
+ Coverage   67.35%   67.82%   +0.47%     
==========================================
  Files          74       75       +1     
  Lines        4046     4177     +131     
==========================================
+ Hits         2725     2833     +108     
- Misses       1195     1209      +14     
- Partials      126      135       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ccojocar]

Thanks for contributing this new analyzer. I left some comments, it would be great if you could address them.

[expp121]

I wasn't sure what you meant in all of your suggestions, but if there's something else that has to be change, please feel free to inform me!

[ccojocar]

I wasn't sure what you meant in all of your suggestions, but if there's something else that has to be change, please feel free to inform me!

Thanks for fixing my review comments. What I meant with (*value) is that you can directly use the value.Method if you pass the value not as pointer because it is already an interface.

I pushed the change in your pull request.

[Jeeppler]

@expp121 Thanks for contributing the rule and the research effort required for it 🚀.

@ccojocar Thank you for reviewing and merging it 🎉 👍 .

[ccojocar]

@expp121 Please could you have a look at these two issues #1209 and #1211 which we need to address since otherwise the analyzer is generating too many false positives. Thanks