Go Path Injection Vulnerability Detection Rule and Defense Guide

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Title: Uncontrolled data used in path expression - ID: go/path-injection - Type: path-problem - Security Severity: 7.5 - Severity: error - Precision: high - Tags: security, external/cwe/cwe-022, external/cwe/cwe-023, external/cwe/cwe-036, external/cwe/cwe-073, external/cwe/cwe-099 - Query Suites: go-code-scanning.qls, go-security-extended.qls, go-security-and-quality.qls 2. Vulnerability Description: - Accessing paths constructed using user-controlled data may allow attackers to access unintended resources. - This could lead to sensitive information being disclosed or deleted, or attackers could alter behavior by modifying unintended files. - Paths may contain special characters such as "..", which could cause the path to point to any location in the filesystem. 3. Recommended Actions: - Validate user input to ensure it does not result in unintended path construction. - Common validation methods include checking whether the path is relative, does not contain ".." components, or is located within a secure directory. - If the path should be a single path component (e.g., a filename), check for the presence of any path separators ("/" or "\") or ".." sequences. - The simplest (but strictest) approach is to use a safe pattern whitelist, ensuring user input matches one of the allowed patterns. 4. Examples: - Examples demonstrate how to read files via HTTP requests and use user-supplied paths to access files. - Examples also show how to prevent path injection attacks by checking whether the path contains path separators or ".." sequences. 5. References: - OWASP: Path Traversal - CWE-22: Common Weakness Enumeration - CWE-23: Common Weakness Enumeration - CWE-36: Common Weakness Enumeration - CWE-73: Common Weakness Enumeration - CWE-99: Common Weakness Enumeration This information provides a detailed description of path injection vulnerabilities, recommended mitigation measures, and relevant references to help developers understand and prevent such vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Go Path Injection Vulnerability Detection Rule and Defense Guide