Standard Library

GoHTTPServer

net/http.Server. ListenAndServe() without TLS is a finding in server configurations that should enforce HTTPS.

1 sink
Taint flow0 sources 1 sink
Sinks — dangerous call
.ListenAndServe()

Sinks

.ListenAndServe()Sink
#
Signature
ListenAndServe() error

Starts HTTP server without TLS. Finding when used in production without HTTPS redirect.

Other Methods

.ListenAndServeTLS()Neutral
#
Signature
ListenAndServeTLS(certFile, keyFile string) error

Starts HTTPS server. Safe — preferred over ListenAndServe.

Fully-Qualified Names

FQNField
net/http.Serverfqns[0]

Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.

Import

go.mod
// standard library — no go.mod entry required
rule.py
from codepathfinder.go_rule import GoHTTPServer

Rules Using This Class