Standard Library

GoOS

The os standard library package. Getenv() is a source of environment variable data. Open(), Create(), Remove() are file operation sinks for path traversal.

1 source4 sinks
Taint flow1 source 4 sinks
Sources — untrusted input
.Getenv()
taint
Sinks — dangerous call
.Open()
.Create()
.Remove()
.ReadFile()

Sources

.Getenv()Source
#
Signature
Getenv(key string) string

Returns environment variable value. Source of external data.

tracks:return

Sinks

.Open()Sink
#
Signature
Open(name string) (*File, error)

Opens file for reading. Path traversal sink when name is user-controlled.

tracks:0
.Create()Sink
#
Signature
Create(name string) (*File, error)

Creates file. Path traversal sink when name is user-controlled.

tracks:0
.Remove()Sink
#
Signature
Remove(name string) error

Removes file. Dangerous sink when name is user-controlled.

tracks:0
.ReadFile()Sink
#
Signature
ReadFile(name string) ([]byte, error)

Reads entire file. Path traversal sink.

tracks:0

Fully-Qualified Names

FQNField
osfqns[0]
os.Filefqns[1]
os.*patterns

Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.

Import

go.mod
// standard library — no go.mod entry required
rule.py
from codepathfinder.go_rule import GoOS

Rules Using This Class