JGC-429 - Bump go 1.25.4 #1483
JGC-429 - Bump go 1.25.4 #1483
Conversation
|
📗 Scan Summary
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewUnsafe deserialization in Go occurs when a program deserializes untrusted Vulnerable exampleimport (
"github.com/go-yaml/yaml"
"net/http"
)
func storeHandler(w http.ResponseWriter, r *http.Request) {
var data map[string]interface{}
yaml.Unmarshal([]byte(r.URL.Query().Get("data")), &data) // NOT OK
}This code uses Remediationimport (
"github.com/go-yaml/yaml"
"net/http"
)
func storeHandler(w http.ResponseWriter, r *http.Request) {
var data map[string]interface{}
yaml.UnmarshalStrict([]byte(r.URL.Query().Get("data")), &data) // SAFE
}Using Code FlowsVulnerable data flow analysis result
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Path Traversal is a type of vulnerability that arises when user-controlled Vulnerable examplefunc serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = 12")
row.Scan(&filePath)
http.ServeFile(w, r, filePath)
}In this example, the RemediationTo mitigate stored path traversal vulnerabilities, it is essential to validate func serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = ?", r.URL.Query().Get("id"))
row.Scan(&filePath)
+ // Validate file path to prevent directory traversal
+ if strings.Contains(filePath, "..") {
+ http.Error(w, "Invalid file path", http.StatusBadRequest)
+ return
+ }
http.ServeFile(w, r, filePath)
}Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Path Traversal is a type of vulnerability that arises when user-controlled Vulnerable examplefunc serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = 12")
row.Scan(&filePath)
http.ServeFile(w, r, filePath)
}In this example, the RemediationTo mitigate stored path traversal vulnerabilities, it is essential to validate func serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = ?", r.URL.Query().Get("id"))
row.Scan(&filePath)
+ // Validate file path to prevent directory traversal
+ if strings.Contains(filePath, "..") {
+ http.Error(w, "Invalid file path", http.StatusBadRequest)
+ return
+ }
http.ServeFile(w, r, filePath)
}Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Path Traversal is a type of vulnerability that arises when user-controlled Vulnerable examplefunc serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = 12")
row.Scan(&filePath)
http.ServeFile(w, r, filePath)
}In this example, the RemediationTo mitigate stored path traversal vulnerabilities, it is essential to validate func serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = ?", r.URL.Query().Get("id"))
row.Scan(&filePath)
+ // Validate file path to prevent directory traversal
+ if strings.Contains(filePath, "..") {
+ http.Error(w, "Invalid file path", http.StatusBadRequest)
+ return
+ }
http.ServeFile(w, r, filePath)
}Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Path Traversal is a type of vulnerability that arises when user-controlled Vulnerable examplefunc serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = 12")
row.Scan(&filePath)
http.ServeFile(w, r, filePath)
}In this example, the RemediationTo mitigate stored path traversal vulnerabilities, it is essential to validate func serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = ?", r.URL.Query().Get("id"))
row.Scan(&filePath)
+ // Validate file path to prevent directory traversal
+ if strings.Contains(filePath, "..") {
+ http.Error(w, "Invalid file path", http.StatusBadRequest)
+ return
+ }
http.ServeFile(w, r, filePath)
}Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Path Traversal is a type of vulnerability that arises when user-controlled Vulnerable examplefunc serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = 12")
row.Scan(&filePath)
http.ServeFile(w, r, filePath)
}In this example, the RemediationTo mitigate stored path traversal vulnerabilities, it is essential to validate func serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = ?", r.URL.Query().Get("id"))
row.Scan(&filePath)
+ // Validate file path to prevent directory traversal
+ if strings.Contains(filePath, "..") {
+ http.Error(w, "Invalid file path", http.StatusBadRequest)
+ return
+ }
http.ServeFile(w, r, filePath)
}Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewUsing insecure protocols—such as HTTP, FTP, or LDAP—can expose sensitive Vulnerable exampleIn this example, the application uses insecure protocols to communicate, package main
import (
"fmt"
)
type SwampService struct {
InsecureHttpProtocol string
InsecureFtpProtocol string
}
func NewSwampService() *SwampService {
return &SwampService{
InsecureHttpProtocol: "http://", // Insecure protocol
InsecureFtpProtocol: "ftp://", // Insecure protocol
}
}
func (s *SwampService) ConnectToFrogService(server string) {
url := s.InsecureHttpProtocol + server + "/frogEndpoint"
s.connect(url)
url = s.InsecureFtpProtocol + server + "/frogFile"
s.connect(url)
}
func (s *SwampService) connect(url string) {
fmt.Printf("Connecting to %s\n", url)
// Logic to connect to the service
}
func main() {
service := NewSwampService()
service.ConnectToFrogService("example.com")
}In this vulnerable example, the RemediationTo mitigate the use of insecure protocols, replace them with secure alternatives package main
import (
"fmt"
)
type SwampService struct {
InsecureHttpProtocol string
InsecureFtpProtocol string
}
func NewSwampService() *SwampService {
return &SwampService{
InsecureHttpProtocol: "https://", // Insecure protocol
InsecureFtpProtocol: "ftps://", // Insecure protocol
}
}
func (s *SwampService) ConnectToFrogService(server string) {
url := s.InsecureHttpProtocol + server + "/frogEndpoint"
s.connect(url)
url = s.InsecureFtpProtocol + server + "/frogFile"
s.connect(url)
}
func (s *SwampService) connect(url string) {
fmt.Printf("Connecting to %s\n", url)
// Logic to connect to the service
}
func main() {
service := NewSwampService()
service.ConnectToFrogService("example.com")
}In this remediated example, the |
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewUsing insecure protocols—such as HTTP, FTP, or LDAP—can expose sensitive Vulnerable exampleIn this example, the application uses insecure protocols to communicate, package main
import (
"fmt"
)
type SwampService struct {
InsecureHttpProtocol string
InsecureFtpProtocol string
}
func NewSwampService() *SwampService {
return &SwampService{
InsecureHttpProtocol: "http://", // Insecure protocol
InsecureFtpProtocol: "ftp://", // Insecure protocol
}
}
func (s *SwampService) ConnectToFrogService(server string) {
url := s.InsecureHttpProtocol + server + "/frogEndpoint"
s.connect(url)
url = s.InsecureFtpProtocol + server + "/frogFile"
s.connect(url)
}
func (s *SwampService) connect(url string) {
fmt.Printf("Connecting to %s\n", url)
// Logic to connect to the service
}
func main() {
service := NewSwampService()
service.ConnectToFrogService("example.com")
}In this vulnerable example, the RemediationTo mitigate the use of insecure protocols, replace them with secure alternatives package main
import (
"fmt"
)
type SwampService struct {
InsecureHttpProtocol string
InsecureFtpProtocol string
}
func NewSwampService() *SwampService {
return &SwampService{
InsecureHttpProtocol: "https://", // Insecure protocol
InsecureFtpProtocol: "ftps://", // Insecure protocol
}
}
func (s *SwampService) ConnectToFrogService(server string) {
url := s.InsecureHttpProtocol + server + "/frogEndpoint"
s.connect(url)
url = s.InsecureFtpProtocol + server + "/frogFile"
s.connect(url)
}
func (s *SwampService) connect(url string) {
fmt.Printf("Connecting to %s\n", url)
// Logic to connect to the service
}
func main() {
service := NewSwampService()
service.ConnectToFrogService("example.com")
}In this remediated example, the |
Uh oh!
There was an error while loading. Please reload this page.