@runsec/mcp 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +578 -0
- package/package.json +43 -0
- package/src/rules/data/rule-compliance-map.json +43563 -0
- package/src/rules/data/semgrep-rules/README-taint-overlays.md +21 -0
- package/src/rules/data/semgrep-rules/advanced-agent-cloud.yaml +802 -0
- package/src/rules/data/semgrep-rules/app-logic.yaml +445 -0
- package/src/rules/data/semgrep-rules/auth-keycloak.yaml +831 -0
- package/src/rules/data/semgrep-rules/browser-agent.yaml +260 -0
- package/src/rules/data/semgrep-rules/cloud-secrets.yaml +316 -0
- package/src/rules/data/semgrep-rules/csharp-dotnet.yaml +4864 -0
- package/src/rules/data/semgrep-rules/desktop-electron-pro.yaml +30 -0
- package/src/rules/data/semgrep-rules/desktop-vsto-suite.yaml +2759 -0
- package/src/rules/data/semgrep-rules/devops-security.yaml +393 -0
- package/src/rules/data/semgrep-rules/domain-access-management.yaml +1023 -0
- package/src/rules/data/semgrep-rules/domain-data-privacy.yaml +852 -0
- package/src/rules/data/semgrep-rules/domain-input-validation.yaml +2894 -0
- package/src/rules/data/semgrep-rules/domain-platform-hardening.yaml +1715 -0
- package/src/rules/data/semgrep-rules/ds-ml-security.yaml +2431 -0
- package/src/rules/data/semgrep-rules/fastapi-async.yaml +5953 -0
- package/src/rules/data/semgrep-rules/frontend-react.yaml +4035 -0
- package/src/rules/data/semgrep-rules/frontend-security.yaml +200 -0
- package/src/rules/data/semgrep-rules/go-core.yaml +4959 -0
- package/src/rules/data/semgrep-rules/hft-cpp-security.yaml +631 -0
- package/src/rules/data/semgrep-rules/infra-k8s-helm.yaml +4968 -0
- package/src/rules/data/semgrep-rules/integration-security.yaml +2362 -0
- package/src/rules/data/semgrep-rules/java-enterprise.yaml +14756 -0
- package/src/rules/data/semgrep-rules/java-spring.yaml +397 -0
- package/src/rules/data/semgrep-rules/license-compliance.yaml +186 -0
- package/src/rules/data/semgrep-rules/mobile-flutter.yaml +37 -0
- package/src/rules/data/semgrep-rules/mobile-security.yaml +721 -0
- package/src/rules/data/semgrep-rules/nodejs-nestjs.yaml +5164 -0
- package/src/rules/data/semgrep-rules/nodejs-security.yaml +326 -0
- package/src/rules/data/semgrep-rules/observability.yaml +381 -0
- package/src/rules/data/semgrep-rules/php-security.yaml +3601 -0
- package/src/rules/data/semgrep-rules/python-backend-pro.yaml +30 -0
- package/src/rules/data/semgrep-rules/python-django.yaml +181 -0
- package/src/rules/data/semgrep-rules/python-security.yaml +284 -0
- package/src/rules/data/semgrep-rules/ru-regulatory.yaml +496 -0
- package/src/rules/data/semgrep-rules/ruby-rails.yaml +3078 -0
- package/src/rules/data/semgrep-rules/rust-security.yaml +2701 -0
|
@@ -0,0 +1,4959 @@
|
|
|
1
|
+
rules:
|
|
2
|
+
- id: runsec.go-core.go-001
|
|
3
|
+
metadata:
|
|
4
|
+
runsec_version: v1.0
|
|
5
|
+
confidence: |-
|
|
6
|
+
0.9
|
|
7
|
+
exploit_scenario: |-
|
|
8
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
9
|
+
fix_template: |-
|
|
10
|
+
action := r.URL.Query().Get("action") allowed := map[string][]string{"uptime": {"uptime"}} ... exec.Command(allowed[action][0]).Run()
|
|
11
|
+
pattern-either:
|
|
12
|
+
- pattern: |-
|
|
13
|
+
cmd := r.URL.Query().Get("cmd")
|
|
14
|
+
...
|
|
15
|
+
exec.Command("sh", "-c", cmd).Run()
|
|
16
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-001\\b'
|
|
17
|
+
message: |-
|
|
18
|
+
RunSec Detection [GO-001]: CWE-78
|
|
19
|
+
languages:
|
|
20
|
+
- go
|
|
21
|
+
severity: WARNING
|
|
22
|
+
- id: runsec.go-core.go-002
|
|
23
|
+
metadata:
|
|
24
|
+
runsec_version: v1.0
|
|
25
|
+
confidence: |-
|
|
26
|
+
0.9
|
|
27
|
+
exploit_scenario: |-
|
|
28
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
29
|
+
fix_template: |-
|
|
30
|
+
host := r.URL.Query().Get("host") if !hostRe.MatchString(host) { return } ... exec.Command("ping", "-c", "1", host).Run()
|
|
31
|
+
pattern-either:
|
|
32
|
+
- pattern: |-
|
|
33
|
+
host := r.URL.Query().Get("host")
|
|
34
|
+
...
|
|
35
|
+
exec.Command("bash", "-c", "ping -c 1 "+host).Run()
|
|
36
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-002\\b'
|
|
37
|
+
message: |-
|
|
38
|
+
RunSec Detection [GO-002]: CWE-77
|
|
39
|
+
languages:
|
|
40
|
+
- go
|
|
41
|
+
severity: WARNING
|
|
42
|
+
- id: runsec.go-core.go-003
|
|
43
|
+
metadata:
|
|
44
|
+
runsec_version: v1.0
|
|
45
|
+
confidence: |-
|
|
46
|
+
0.9
|
|
47
|
+
exploit_scenario: |-
|
|
48
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
49
|
+
fix_template: |-
|
|
50
|
+
order := r.URL.Query().Get("order") if order != "name" && order != "created_at" { order = "name" } ... q := "SELECT * FROM users ORDER BY " + order
|
|
51
|
+
pattern-either:
|
|
52
|
+
- pattern: |-
|
|
53
|
+
order := r.URL.Query().Get("order")
|
|
54
|
+
...
|
|
55
|
+
q := "SELECT * FROM users ORDER BY " + order
|
|
56
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-003\\b'
|
|
57
|
+
message: |-
|
|
58
|
+
RunSec Detection [GO-003]: CWE-74
|
|
59
|
+
languages:
|
|
60
|
+
- go
|
|
61
|
+
severity: WARNING
|
|
62
|
+
- id: runsec.go-core.go-004
|
|
63
|
+
metadata:
|
|
64
|
+
runsec_version: v1.0
|
|
65
|
+
confidence: |-
|
|
66
|
+
0.9
|
|
67
|
+
exploit_scenario: |-
|
|
68
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
69
|
+
fix_template: |-
|
|
70
|
+
m := r.URL.Query().Get("method") if m != "Health" && m != "Status" { return } ... reflect.ValueOf(handler).MethodByName(m).Call(nil)
|
|
71
|
+
pattern-either:
|
|
72
|
+
- pattern: |-
|
|
73
|
+
m := r.URL.Query().Get("method")
|
|
74
|
+
...
|
|
75
|
+
reflect.ValueOf(handler).MethodByName(m).Call(nil)
|
|
76
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-004\\b'
|
|
77
|
+
message: |-
|
|
78
|
+
RunSec Detection [GO-004]: CWE-470
|
|
79
|
+
languages:
|
|
80
|
+
- go
|
|
81
|
+
severity: WARNING
|
|
82
|
+
- id: runsec.go-core.go-005
|
|
83
|
+
metadata:
|
|
84
|
+
runsec_version: v1.0
|
|
85
|
+
confidence: |-
|
|
86
|
+
0.9
|
|
87
|
+
exploit_scenario: |-
|
|
88
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
89
|
+
fix_template: |-
|
|
90
|
+
name := r.URL.Query().Get("plugin") if _, ok := allowedPlugins[name]; !ok { return } ... plugin.Open(allowedPlugins[name])
|
|
91
|
+
pattern-either:
|
|
92
|
+
- pattern: |-
|
|
93
|
+
name := r.URL.Query().Get("plugin")
|
|
94
|
+
...
|
|
95
|
+
plugin.Open(name)
|
|
96
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-005\\b'
|
|
97
|
+
message: |-
|
|
98
|
+
RunSec Detection [GO-005]: CWE-470
|
|
99
|
+
languages:
|
|
100
|
+
- go
|
|
101
|
+
severity: WARNING
|
|
102
|
+
- id: runsec.go-core.go-006
|
|
103
|
+
metadata:
|
|
104
|
+
runsec_version: v1.0
|
|
105
|
+
confidence: |-
|
|
106
|
+
0.9
|
|
107
|
+
exploit_scenario: |-
|
|
108
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
109
|
+
fix_template: |-
|
|
110
|
+
cmd := r.FormValue("cmd") if cmd != "normalize" { return } ... vm.RunString("normalize(input)")
|
|
111
|
+
pattern-either:
|
|
112
|
+
- pattern: |-
|
|
113
|
+
script := r.FormValue("script")
|
|
114
|
+
...
|
|
115
|
+
vm.RunString(script)
|
|
116
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-006\\b'
|
|
117
|
+
message: |-
|
|
118
|
+
RunSec Detection [GO-006]: CWE-95
|
|
119
|
+
languages:
|
|
120
|
+
- go
|
|
121
|
+
severity: WARNING
|
|
122
|
+
- id: runsec.go-core.go-007
|
|
123
|
+
metadata:
|
|
124
|
+
runsec_version: v1.0
|
|
125
|
+
confidence: |-
|
|
126
|
+
0.9
|
|
127
|
+
exploit_scenario: |-
|
|
128
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
129
|
+
fix_template: |-
|
|
130
|
+
name := r.FormValue("template") if _, ok := safeTemplates[name]; !ok { return } ... template.Must(template.ParseFiles(safeTemplates[name]))
|
|
131
|
+
pattern-either:
|
|
132
|
+
- pattern: |-
|
|
133
|
+
tpl := r.FormValue("tpl")
|
|
134
|
+
...
|
|
135
|
+
template.Must(template.New("x").Parse(tpl))
|
|
136
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-007\\b'
|
|
137
|
+
message: |-
|
|
138
|
+
RunSec Detection [GO-007]: CWE-94
|
|
139
|
+
languages:
|
|
140
|
+
- go
|
|
141
|
+
severity: WARNING
|
|
142
|
+
- id: runsec.go-core.go-008
|
|
143
|
+
metadata:
|
|
144
|
+
runsec_version: v1.0
|
|
145
|
+
confidence: |-
|
|
146
|
+
0.9
|
|
147
|
+
exploit_scenario: |-
|
|
148
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
149
|
+
fix_template: |-
|
|
150
|
+
tool := payload["tool"] allowed := map[string][]string{"date": {"date"}} if _, ok := allowed[tool.(string)]; !ok { return } ... exec.Command(allowed[tool.(string)][0]).Run()
|
|
151
|
+
pattern-either:
|
|
152
|
+
- pattern: |-
|
|
153
|
+
tool := payload["tool"]
|
|
154
|
+
...
|
|
155
|
+
exec.Command(tool.(string)).Run()
|
|
156
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-008\\b'
|
|
157
|
+
message: |-
|
|
158
|
+
RunSec Detection [GO-008]: CWE-78
|
|
159
|
+
languages:
|
|
160
|
+
- go
|
|
161
|
+
severity: WARNING
|
|
162
|
+
- id: runsec.go-core.go-009
|
|
163
|
+
metadata:
|
|
164
|
+
runsec_version: v1.0
|
|
165
|
+
confidence: |-
|
|
166
|
+
0.9
|
|
167
|
+
exploit_scenario: |-
|
|
168
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
169
|
+
fix_template: |-
|
|
170
|
+
go func(ctx context.Context) { for { select { case <-ctx.Done(): return default: ... } } }(ctx)
|
|
171
|
+
pattern-either:
|
|
172
|
+
- pattern: |-
|
|
173
|
+
go func() {
|
|
174
|
+
for {
|
|
175
|
+
...
|
|
176
|
+
}
|
|
177
|
+
}()
|
|
178
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-009\\b'
|
|
179
|
+
message: |-
|
|
180
|
+
RunSec Detection [GO-009]: CWE-400
|
|
181
|
+
languages:
|
|
182
|
+
- go
|
|
183
|
+
severity: WARNING
|
|
184
|
+
- id: runsec.go-core.go-010
|
|
185
|
+
metadata:
|
|
186
|
+
runsec_version: v1.0
|
|
187
|
+
confidence: |-
|
|
188
|
+
0.9
|
|
189
|
+
exploit_scenario: |-
|
|
190
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
191
|
+
fix_template: |-
|
|
192
|
+
name := r.URL.Query().Get("file") clean := filepath.Clean("/" + name) target := filepath.Join(root, clean) if !strings.HasPrefix(target, root) { return }
|
|
193
|
+
pattern-either:
|
|
194
|
+
- pattern: |-
|
|
195
|
+
name := r.URL.Query().Get("file")
|
|
196
|
+
...
|
|
197
|
+
target := filepath.Join(root, name)
|
|
198
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-010\\b'
|
|
199
|
+
message: |-
|
|
200
|
+
RunSec Detection [GO-010]: CWE-22
|
|
201
|
+
languages:
|
|
202
|
+
- go
|
|
203
|
+
severity: WARNING
|
|
204
|
+
- id: runsec.go-core.go-011
|
|
205
|
+
metadata:
|
|
206
|
+
runsec_version: v1.0
|
|
207
|
+
confidence: |-
|
|
208
|
+
0.9
|
|
209
|
+
exploit_scenario: |-
|
|
210
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
211
|
+
fix_template: |-
|
|
212
|
+
url := r.URL.Query().Get("url") host := parseHost(url) allowed := map[string]bool{"api.example.com": true} if !allowed[host] { return } resp, _ := http.Get(url)
|
|
213
|
+
pattern-either:
|
|
214
|
+
- pattern: |-
|
|
215
|
+
url := r.URL.Query().Get("url")
|
|
216
|
+
...
|
|
217
|
+
resp, _ := http.Get(url)
|
|
218
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-011\\b'
|
|
219
|
+
message: |-
|
|
220
|
+
RunSec Detection [GO-011]: CWE-918
|
|
221
|
+
languages:
|
|
222
|
+
- go
|
|
223
|
+
severity: WARNING
|
|
224
|
+
- id: runsec.go-core.go-012
|
|
225
|
+
metadata:
|
|
226
|
+
runsec_version: v1.0
|
|
227
|
+
confidence: |-
|
|
228
|
+
0.9
|
|
229
|
+
exploit_scenario: |-
|
|
230
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
231
|
+
fix_template: |-
|
|
232
|
+
buf := make([]byte, n) ... _ = buf[offset:] // avoid unsafe pointer arithmetic
|
|
233
|
+
pattern-either:
|
|
234
|
+
- pattern: |-
|
|
235
|
+
var ptr unsafe.Pointer
|
|
236
|
+
...
|
|
237
|
+
ptr2 := unsafe.Pointer(uintptr(ptr) + offset)
|
|
238
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-012\\b'
|
|
239
|
+
message: |-
|
|
240
|
+
RunSec Detection [GO-012]: CWE-242
|
|
241
|
+
languages:
|
|
242
|
+
- go
|
|
243
|
+
severity: WARNING
|
|
244
|
+
- id: runsec.go-core.go-013
|
|
245
|
+
metadata:
|
|
246
|
+
runsec_version: v1.0
|
|
247
|
+
confidence: |-
|
|
248
|
+
0.9
|
|
249
|
+
exploit_scenario: |-
|
|
250
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
251
|
+
fix_template: |-
|
|
252
|
+
... h := sha256.New()
|
|
253
|
+
pattern-either:
|
|
254
|
+
- pattern: |-
|
|
255
|
+
...
|
|
256
|
+
h := md5.New()
|
|
257
|
+
...
|
|
258
|
+
h2 := sha1.New()
|
|
259
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-013\\b'
|
|
260
|
+
message: |-
|
|
261
|
+
RunSec Detection [GO-013]: CWE-327
|
|
262
|
+
languages:
|
|
263
|
+
- go
|
|
264
|
+
severity: WARNING
|
|
265
|
+
- id: runsec.go-core.go-014
|
|
266
|
+
metadata:
|
|
267
|
+
runsec_version: v1.0
|
|
268
|
+
confidence: |-
|
|
269
|
+
0.9
|
|
270
|
+
exploit_scenario: |-
|
|
271
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
272
|
+
fix_template: |-
|
|
273
|
+
next := r.URL.Query().Get("next") if !isRelativeOrAllowed(next) { next = "/" } http.Redirect(w, r, next, http.StatusFound)
|
|
274
|
+
pattern-either:
|
|
275
|
+
- pattern: |-
|
|
276
|
+
next := r.URL.Query().Get("next")
|
|
277
|
+
...
|
|
278
|
+
http.Redirect(w, r, next, http.StatusFound)
|
|
279
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-014\\b'
|
|
280
|
+
message: |-
|
|
281
|
+
RunSec Detection [GO-014]: CWE-601
|
|
282
|
+
languages:
|
|
283
|
+
- go
|
|
284
|
+
severity: WARNING
|
|
285
|
+
- id: runsec.go-core.go-015
|
|
286
|
+
metadata:
|
|
287
|
+
runsec_version: v1.0
|
|
288
|
+
confidence: |-
|
|
289
|
+
0.9
|
|
290
|
+
exploit_scenario: |-
|
|
291
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
292
|
+
fix_template: |-
|
|
293
|
+
userInput := r.URL.Query().Get("user") safe := strings.NewReplacer("\\n", "\\\\n", "\\r", "\\\\r").Replace(userInput) ... log.Printf("User: %s", safe)
|
|
294
|
+
pattern-either:
|
|
295
|
+
- pattern: |-
|
|
296
|
+
userInput := r.URL.Query().Get("user")
|
|
297
|
+
...
|
|
298
|
+
log.Printf("User: %s", userInput)
|
|
299
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-015\\b'
|
|
300
|
+
message: |-
|
|
301
|
+
RunSec Detection [GO-015]: CWE-117
|
|
302
|
+
languages:
|
|
303
|
+
- go
|
|
304
|
+
severity: WARNING
|
|
305
|
+
- id: runsec.go-core.go-016
|
|
306
|
+
metadata:
|
|
307
|
+
runsec_version: v1.0
|
|
308
|
+
confidence: |-
|
|
309
|
+
0.9
|
|
310
|
+
exploit_scenario: |-
|
|
311
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
312
|
+
fix_template: |-
|
|
313
|
+
apiKey := os.Getenv("API_KEY") if apiKey == "" { panic("missing API_KEY") }
|
|
314
|
+
pattern-either:
|
|
315
|
+
- pattern: |-
|
|
316
|
+
const apiKey = "prod-api-key-12345"
|
|
317
|
+
...
|
|
318
|
+
token := "hardcoded-token"
|
|
319
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-016\\b'
|
|
320
|
+
message: |-
|
|
321
|
+
RunSec Detection [GO-016]: CWE-798
|
|
322
|
+
languages:
|
|
323
|
+
- go
|
|
324
|
+
severity: WARNING
|
|
325
|
+
- id: runsec.go-core.go-017
|
|
326
|
+
metadata:
|
|
327
|
+
runsec_version: v1.0
|
|
328
|
+
confidence: |-
|
|
329
|
+
0.9
|
|
330
|
+
exploit_scenario: |-
|
|
331
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
332
|
+
fix_template: |-
|
|
333
|
+
... mu.Lock() counter = counter + 1 mu.Unlock()
|
|
334
|
+
pattern-either:
|
|
335
|
+
- pattern: |-
|
|
336
|
+
...
|
|
337
|
+
counter++
|
|
338
|
+
...
|
|
339
|
+
go func() {
|
|
340
|
+
counter = counter + 1
|
|
341
|
+
}()
|
|
342
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-017\\b'
|
|
343
|
+
message: |-
|
|
344
|
+
RunSec Detection [GO-017]: CWE-362
|
|
345
|
+
languages:
|
|
346
|
+
- go
|
|
347
|
+
severity: WARNING
|
|
348
|
+
- id: runsec.go-core.go-018
|
|
349
|
+
metadata:
|
|
350
|
+
runsec_version: v1.0
|
|
351
|
+
confidence: |-
|
|
352
|
+
0.9
|
|
353
|
+
exploit_scenario: |-
|
|
354
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
355
|
+
fix_template: |-
|
|
356
|
+
token, _ := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) { if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok { return nil, fmt.Errorf("unexpected signing method") } return key, nil })
|
|
357
|
+
pattern-either:
|
|
358
|
+
- pattern: |-
|
|
359
|
+
token, _ := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
|
|
360
|
+
return key, nil
|
|
361
|
+
})
|
|
362
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-018\\b'
|
|
363
|
+
message: |-
|
|
364
|
+
RunSec Detection [GO-018]: CWE-287
|
|
365
|
+
languages:
|
|
366
|
+
- go
|
|
367
|
+
severity: WARNING
|
|
368
|
+
- id: runsec.go-core.go-019
|
|
369
|
+
metadata:
|
|
370
|
+
runsec_version: v1.0
|
|
371
|
+
confidence: |-
|
|
372
|
+
0.9
|
|
373
|
+
exploit_scenario: |-
|
|
374
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
375
|
+
fix_template: |-
|
|
376
|
+
rows, err := db.Query(query) if err != nil { return err } defer rows.Close() ...
|
|
377
|
+
pattern-either:
|
|
378
|
+
- pattern: |-
|
|
379
|
+
rows, _ := db.Query(query)
|
|
380
|
+
...
|
|
381
|
+
for rows.Next() {
|
|
382
|
+
...
|
|
383
|
+
}
|
|
384
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-019\\b'
|
|
385
|
+
message: |-
|
|
386
|
+
RunSec Detection [GO-019]: CWE-770
|
|
387
|
+
languages:
|
|
388
|
+
- go
|
|
389
|
+
severity: WARNING
|
|
390
|
+
- id: runsec.go-core.go-020
|
|
391
|
+
metadata:
|
|
392
|
+
runsec_version: v1.0
|
|
393
|
+
confidence: |-
|
|
394
|
+
0.9
|
|
395
|
+
exploit_scenario: |-
|
|
396
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
397
|
+
fix_template: |-
|
|
398
|
+
tr := &http.Transport{ TLSClientConfig: &tls.Config{InsecureSkipVerify: false}, }
|
|
399
|
+
pattern-either:
|
|
400
|
+
- pattern: |-
|
|
401
|
+
tr := &http.Transport{
|
|
402
|
+
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
|
|
403
|
+
}
|
|
404
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-020\\b'
|
|
405
|
+
message: |-
|
|
406
|
+
RunSec Detection [GO-020]: CWE-295
|
|
407
|
+
languages:
|
|
408
|
+
- go
|
|
409
|
+
severity: WARNING
|
|
410
|
+
- id: runsec.go-core.go-021
|
|
411
|
+
metadata:
|
|
412
|
+
runsec_version: v1.0
|
|
413
|
+
confidence: |-
|
|
414
|
+
0.9
|
|
415
|
+
exploit_scenario: |-
|
|
416
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
417
|
+
fix_template: |-
|
|
418
|
+
f, err := os.Open(path) if err != nil { return err } defer f.Close() ...
|
|
419
|
+
pattern-either:
|
|
420
|
+
- pattern: |-
|
|
421
|
+
f, _ := os.Open(path)
|
|
422
|
+
...
|
|
423
|
+
data, _ := io.ReadAll(f)
|
|
424
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-021\\b'
|
|
425
|
+
message: |-
|
|
426
|
+
RunSec Detection [GO-021]: CWE-404
|
|
427
|
+
languages:
|
|
428
|
+
- go
|
|
429
|
+
severity: WARNING
|
|
430
|
+
- id: runsec.go-core.go-022
|
|
431
|
+
metadata:
|
|
432
|
+
runsec_version: v1.0
|
|
433
|
+
confidence: |-
|
|
434
|
+
0.9
|
|
435
|
+
exploit_scenario: |-
|
|
436
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
437
|
+
fix_template: |-
|
|
438
|
+
tmpl := template.Must(template.New("x").Parse("Hello {{.Name}}")) ... tmpl.Execute(w, map[string]string{"Name": name})
|
|
439
|
+
pattern-either:
|
|
440
|
+
- pattern: |-
|
|
441
|
+
name := r.URL.Query().Get("name")
|
|
442
|
+
...
|
|
443
|
+
fmt.Fprintf(w, name)
|
|
444
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-022\\b'
|
|
445
|
+
message: |-
|
|
446
|
+
RunSec Detection [GO-022]: CWE-116
|
|
447
|
+
languages:
|
|
448
|
+
- go
|
|
449
|
+
severity: WARNING
|
|
450
|
+
- id: runsec.go-core.go-023
|
|
451
|
+
metadata:
|
|
452
|
+
runsec_version: v1.0
|
|
453
|
+
confidence: |-
|
|
454
|
+
0.9
|
|
455
|
+
exploit_scenario: |-
|
|
456
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
457
|
+
fix_template: |-
|
|
458
|
+
body, _ := io.ReadAll(io.LimitReader(r.Body, maxBytes)) ... _ = body
|
|
459
|
+
pattern-either:
|
|
460
|
+
- pattern: |-
|
|
461
|
+
body, _ := ioutil.ReadAll(r.Body)
|
|
462
|
+
...
|
|
463
|
+
_ = body
|
|
464
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-023\\b'
|
|
465
|
+
message: |-
|
|
466
|
+
RunSec Detection [GO-023]: CWE-20
|
|
467
|
+
languages:
|
|
468
|
+
- go
|
|
469
|
+
severity: WARNING
|
|
470
|
+
- id: runsec.go-core.go-024
|
|
471
|
+
metadata:
|
|
472
|
+
runsec_version: v1.0
|
|
473
|
+
confidence: |-
|
|
474
|
+
0.9
|
|
475
|
+
exploit_scenario: |-
|
|
476
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
477
|
+
fix_template: |-
|
|
478
|
+
if debugEnabled { mux := http.NewServeMux() ... http.ListenAndServe("127.0.0.1:6060", mux) }
|
|
479
|
+
pattern-either:
|
|
480
|
+
- pattern: |-
|
|
481
|
+
import _ "net/http/pprof"
|
|
482
|
+
...
|
|
483
|
+
http.ListenAndServe(":6060", nil)
|
|
484
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-024\\b'
|
|
485
|
+
message: |-
|
|
486
|
+
RunSec Detection [GO-024]: CWE-489
|
|
487
|
+
languages:
|
|
488
|
+
- go
|
|
489
|
+
severity: WARNING
|
|
490
|
+
- id: runsec.go-core.go-025
|
|
491
|
+
metadata:
|
|
492
|
+
runsec_version: v1.0
|
|
493
|
+
confidence: |-
|
|
494
|
+
0.9
|
|
495
|
+
exploit_scenario: |-
|
|
496
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
497
|
+
fix_template: |-
|
|
498
|
+
srv := grpc.NewServer(grpc.UnaryInterceptor(grpc_auth.UnaryServerInterceptor(authFunc))) ... func authFunc(ctx context.Context) (context.Context, error) { md, _ := metadata.FromIncomingContext(ctx) ... return ctx, nil }
|
|
499
|
+
pattern-either:
|
|
500
|
+
- pattern: |-
|
|
501
|
+
func (s *Server) Transfer(ctx context.Context, req *pb.TransferRequest) (*pb.TransferReply, error) {
|
|
502
|
+
...
|
|
503
|
+
return s.svc.Transfer(ctx, req)
|
|
504
|
+
}
|
|
505
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-025\\b'
|
|
506
|
+
message: |-
|
|
507
|
+
RunSec Detection [GO-025]: CWE-285
|
|
508
|
+
languages:
|
|
509
|
+
- go
|
|
510
|
+
severity: WARNING
|
|
511
|
+
- id: runsec.go-core.go-026
|
|
512
|
+
metadata:
|
|
513
|
+
runsec_version: v1.0
|
|
514
|
+
confidence: |-
|
|
515
|
+
0.9
|
|
516
|
+
exploit_scenario: |-
|
|
517
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
518
|
+
fix_template: |-
|
|
519
|
+
for _, f := range zipReader.File { targetPath := filepath.Join(dest, f.Name) clean := filepath.Clean(targetPath) if !strings.HasPrefix(clean, filepath.Clean(dest)+string(os.PathSeparator)) { return fmt.Errorf("zip slip detected") } writeFile(clean, f) }
|
|
520
|
+
pattern-either:
|
|
521
|
+
- pattern: |-
|
|
522
|
+
for _, f := range zipReader.File {
|
|
523
|
+
...
|
|
524
|
+
targetPath := filepath.Join(dest, f.Name)
|
|
525
|
+
writeFile(targetPath, f)
|
|
526
|
+
}
|
|
527
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-026\\b'
|
|
528
|
+
message: |-
|
|
529
|
+
RunSec Detection [GO-026]: CWE-22
|
|
530
|
+
languages:
|
|
531
|
+
- go
|
|
532
|
+
severity: WARNING
|
|
533
|
+
- id: runsec.go-core.go-027
|
|
534
|
+
metadata:
|
|
535
|
+
runsec_version: v1.0
|
|
536
|
+
confidence: |-
|
|
537
|
+
0.9
|
|
538
|
+
exploit_scenario: |-
|
|
539
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
540
|
+
fix_template: |-
|
|
541
|
+
proxy := &httputil.ReverseProxy{ Director: func(req *http.Request) { ... req.Header = cloneAllowedHeaders(r.Header) stripHopByHop(req.Header) }, }
|
|
542
|
+
pattern-either:
|
|
543
|
+
- pattern: |-
|
|
544
|
+
proxy := &httputil.ReverseProxy{
|
|
545
|
+
Director: func(req *http.Request) {
|
|
546
|
+
...
|
|
547
|
+
req.Header = r.Header
|
|
548
|
+
},
|
|
549
|
+
}
|
|
550
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-027\\b'
|
|
551
|
+
message: |-
|
|
552
|
+
RunSec Detection [GO-027]: CWE-444
|
|
553
|
+
languages:
|
|
554
|
+
- go
|
|
555
|
+
severity: WARNING
|
|
556
|
+
- id: runsec.go-core.go-028
|
|
557
|
+
metadata:
|
|
558
|
+
runsec_version: v1.0
|
|
559
|
+
confidence: |-
|
|
560
|
+
0.9
|
|
561
|
+
exploit_scenario: |-
|
|
562
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
563
|
+
fix_template: |-
|
|
564
|
+
func CopyMessage(msg proto.Message) proto.Message { ... return proto.Clone(msg) }
|
|
565
|
+
pattern-either:
|
|
566
|
+
- pattern: |-
|
|
567
|
+
func DeepCopy(dst, src interface{}) {
|
|
568
|
+
...
|
|
569
|
+
reflect.ValueOf(dst).Elem().Set(reflect.ValueOf(src).Elem())
|
|
570
|
+
}
|
|
571
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-028\\b'
|
|
572
|
+
message: |-
|
|
573
|
+
RunSec Detection [GO-028]: CWE-20
|
|
574
|
+
languages:
|
|
575
|
+
- go
|
|
576
|
+
severity: WARNING
|
|
577
|
+
- id: runsec.go-core.go-029
|
|
578
|
+
metadata:
|
|
579
|
+
runsec_version: v1.0
|
|
580
|
+
confidence: |-
|
|
581
|
+
0.9
|
|
582
|
+
exploit_scenario: |-
|
|
583
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
584
|
+
fix_template: |-
|
|
585
|
+
pem, err := os.ReadFile("/etc/ssl/certs/internal-ca.pem") ... pool.AppendCertsFromPEM(pem)
|
|
586
|
+
pattern-either:
|
|
587
|
+
- pattern: |-
|
|
588
|
+
const rootPEM = "-----BEGIN CERTIFICATE-----..."
|
|
589
|
+
...
|
|
590
|
+
pool.AppendCertsFromPEM([]byte(rootPEM))
|
|
591
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-029\\b'
|
|
592
|
+
message: |-
|
|
593
|
+
RunSec Detection [GO-029]: CWE-295
|
|
594
|
+
languages:
|
|
595
|
+
- go
|
|
596
|
+
severity: WARNING
|
|
597
|
+
- id: runsec.go-core.go-030
|
|
598
|
+
metadata:
|
|
599
|
+
runsec_version: v1.0
|
|
600
|
+
confidence: |-
|
|
601
|
+
0.9
|
|
602
|
+
exploit_scenario: |-
|
|
603
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
604
|
+
fix_template: |-
|
|
605
|
+
srv := grpc.NewServer(grpc.MaxRecvMsgSize(4*1024*1024)) ... pb.RegisterApiServer(srv, api)
|
|
606
|
+
pattern-either:
|
|
607
|
+
- pattern: |-
|
|
608
|
+
srv := grpc.NewServer()
|
|
609
|
+
...
|
|
610
|
+
pb.RegisterApiServer(srv, api)
|
|
611
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-030\\b'
|
|
612
|
+
message: |-
|
|
613
|
+
RunSec Detection [GO-030]: CWE-770
|
|
614
|
+
languages:
|
|
615
|
+
- go
|
|
616
|
+
severity: WARNING
|
|
617
|
+
- id: runsec.go-core.go-031
|
|
618
|
+
metadata:
|
|
619
|
+
runsec_version: v1.0
|
|
620
|
+
confidence: |-
|
|
621
|
+
0.9
|
|
622
|
+
exploit_scenario: |-
|
|
623
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
624
|
+
fix_template: |-
|
|
625
|
+
b := make([]byte, 32) ... if _, err := cryptorand.Read(b); err != nil { return err }
|
|
626
|
+
pattern-either:
|
|
627
|
+
- pattern: |-
|
|
628
|
+
b := make([]byte, 32)
|
|
629
|
+
...
|
|
630
|
+
for i := range b {
|
|
631
|
+
b[i] = byte(rand.Intn(256))
|
|
632
|
+
}
|
|
633
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-031\\b'
|
|
634
|
+
message: |-
|
|
635
|
+
RunSec Detection [GO-031]: CWE-327
|
|
636
|
+
languages:
|
|
637
|
+
- go
|
|
638
|
+
severity: WARNING
|
|
639
|
+
- id: runsec.go-core.go-032
|
|
640
|
+
metadata:
|
|
641
|
+
runsec_version: v1.0
|
|
642
|
+
confidence: |-
|
|
643
|
+
0.9
|
|
644
|
+
exploit_scenario: |-
|
|
645
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
646
|
+
fix_template: |-
|
|
647
|
+
raw, _ := io.ReadAll(io.LimitReader(r.Body, maxBytes)) ... json.Unmarshal(raw, &payload)
|
|
648
|
+
pattern-either:
|
|
649
|
+
- pattern: |-
|
|
650
|
+
raw, _ := io.ReadAll(r.Body)
|
|
651
|
+
...
|
|
652
|
+
json.Unmarshal(raw, &payload)
|
|
653
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-032\\b'
|
|
654
|
+
message: |-
|
|
655
|
+
RunSec Detection [GO-032]: CWE-400
|
|
656
|
+
languages:
|
|
657
|
+
- go
|
|
658
|
+
severity: WARNING
|
|
659
|
+
- id: runsec.go-core.go-033
|
|
660
|
+
metadata:
|
|
661
|
+
runsec_version: v1.0
|
|
662
|
+
confidence: |-
|
|
663
|
+
0.9
|
|
664
|
+
exploit_scenario: |-
|
|
665
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
666
|
+
fix_template: |-
|
|
667
|
+
name := r.URL.Query().Get("name") ... db.Where("name = ?", name).Find(&users) ... db.Raw("SELECT * FROM users WHERE name = ?", name).Scan(&users)
|
|
668
|
+
pattern-either:
|
|
669
|
+
- pattern: |-
|
|
670
|
+
name := r.URL.Query().Get("name")
|
|
671
|
+
...
|
|
672
|
+
db.Where("name = '" + name + "'").Find(&users)
|
|
673
|
+
...
|
|
674
|
+
db.Raw("SELECT * FROM users WHERE name = '" + name + "'").Scan(&users)
|
|
675
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-033\\b'
|
|
676
|
+
message: |-
|
|
677
|
+
RunSec Detection [GO-033]: CWE-89
|
|
678
|
+
languages:
|
|
679
|
+
- go
|
|
680
|
+
severity: WARNING
|
|
681
|
+
- id: runsec.go-core.go-034
|
|
682
|
+
metadata:
|
|
683
|
+
runsec_version: v1.0
|
|
684
|
+
confidence: |-
|
|
685
|
+
0.9
|
|
686
|
+
exploit_scenario: |-
|
|
687
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
688
|
+
fix_template: |-
|
|
689
|
+
input := r.URL.Query().Get("html") tmpl := template.Must(template.New("x").Parse("{{.Content}}")) ... tmpl.Execute(w, map[string]string{"Content": input})
|
|
690
|
+
pattern-either:
|
|
691
|
+
- pattern: |-
|
|
692
|
+
input := r.URL.Query().Get("html")
|
|
693
|
+
...
|
|
694
|
+
unsafeHTML := template.HTML(input)
|
|
695
|
+
fmt.Fprint(w, unsafeHTML)
|
|
696
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-034\\b'
|
|
697
|
+
message: |-
|
|
698
|
+
RunSec Detection [GO-034]: CWE-79
|
|
699
|
+
languages:
|
|
700
|
+
- go
|
|
701
|
+
severity: WARNING
|
|
702
|
+
- id: runsec.go-core.go-035
|
|
703
|
+
metadata:
|
|
704
|
+
runsec_version: v1.0
|
|
705
|
+
confidence: |-
|
|
706
|
+
0.9
|
|
707
|
+
exploit_scenario: |-
|
|
708
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
709
|
+
fix_template: |-
|
|
710
|
+
err := someInternalError ... log.Printf("internal error: %v", err) return errors.New("internal server error")
|
|
711
|
+
pattern-either:
|
|
712
|
+
- pattern: |-
|
|
713
|
+
err := someInternalError
|
|
714
|
+
...
|
|
715
|
+
return fmt.Errorf("db=%s secret=%s path=%s", dsn, apiKey, filePath)
|
|
716
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-035\\b'
|
|
717
|
+
message: |-
|
|
718
|
+
RunSec Detection [GO-035]: CWE-209
|
|
719
|
+
languages:
|
|
720
|
+
- go
|
|
721
|
+
severity: WARNING
|
|
722
|
+
- id: runsec.go-core.go-036
|
|
723
|
+
metadata:
|
|
724
|
+
runsec_version: v1.0
|
|
725
|
+
confidence: |-
|
|
726
|
+
0.9
|
|
727
|
+
exploit_scenario: |-
|
|
728
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
729
|
+
fix_template: |-
|
|
730
|
+
buf := []byte(input) cbuf := C.CBytes(buf) defer C.free(cbuf) ... C.process(cbuf)
|
|
731
|
+
pattern-either:
|
|
732
|
+
- pattern: |-
|
|
733
|
+
...
|
|
734
|
+
ptr := unsafe.Pointer(uintptr(cptr) + offset)
|
|
735
|
+
C.process(ptr)
|
|
736
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-036\\b'
|
|
737
|
+
message: |-
|
|
738
|
+
RunSec Detection [GO-036]: CWE-119
|
|
739
|
+
languages:
|
|
740
|
+
- go
|
|
741
|
+
severity: WARNING
|
|
742
|
+
- id: runsec.go-core.go-037
|
|
743
|
+
metadata:
|
|
744
|
+
runsec_version: v1.0
|
|
745
|
+
confidence: |-
|
|
746
|
+
0.9
|
|
747
|
+
exploit_scenario: |-
|
|
748
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
749
|
+
fix_template: |-
|
|
750
|
+
allowed := map[string]bool{"name": true, "email": true} for k, v := range incomingMap { if allowed[k] { targetMap[k] = v } }
|
|
751
|
+
pattern-either:
|
|
752
|
+
- pattern: |-
|
|
753
|
+
for k, v := range incomingMap {
|
|
754
|
+
targetMap[k] = v
|
|
755
|
+
}
|
|
756
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-037\\b'
|
|
757
|
+
message: |-
|
|
758
|
+
RunSec Detection [GO-037]: CWE-915
|
|
759
|
+
languages:
|
|
760
|
+
- go
|
|
761
|
+
severity: WARNING
|
|
762
|
+
- id: runsec.go-core.go-038
|
|
763
|
+
metadata:
|
|
764
|
+
runsec_version: v1.0
|
|
765
|
+
confidence: |-
|
|
766
|
+
0.9
|
|
767
|
+
exploit_scenario: |-
|
|
768
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
769
|
+
fix_template: |-
|
|
770
|
+
xmlParser := customxml.NewParser() ... xmlParser.DisableExternalEntities(true) xmlParser.Parse(rawXML)
|
|
771
|
+
pattern-either:
|
|
772
|
+
- pattern: |-
|
|
773
|
+
xmlParser := customxml.NewParser()
|
|
774
|
+
...
|
|
775
|
+
xmlParser.Parse(rawXML)
|
|
776
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-038\\b'
|
|
777
|
+
message: |-
|
|
778
|
+
RunSec Detection [GO-038]: CWE-611
|
|
779
|
+
languages:
|
|
780
|
+
- go
|
|
781
|
+
severity: WARNING
|
|
782
|
+
- id: runsec.go-core.go-039
|
|
783
|
+
metadata:
|
|
784
|
+
runsec_version: v1.0
|
|
785
|
+
confidence: |-
|
|
786
|
+
0.9
|
|
787
|
+
exploit_scenario: |-
|
|
788
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
789
|
+
fix_template: |-
|
|
790
|
+
if len(longUserInput) > 2048 { return } re := regexp.MustCompile(userRegex) ... re.MatchString(longUserInput)
|
|
791
|
+
pattern-either:
|
|
792
|
+
- pattern: |-
|
|
793
|
+
re := regexp.MustCompile(userRegex)
|
|
794
|
+
...
|
|
795
|
+
re.MatchString(longUserInput)
|
|
796
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-039\\b'
|
|
797
|
+
message: |-
|
|
798
|
+
RunSec Detection [GO-039]: CWE-400
|
|
799
|
+
languages:
|
|
800
|
+
- go
|
|
801
|
+
severity: WARNING
|
|
802
|
+
- id: runsec.go-core.go-040
|
|
803
|
+
metadata:
|
|
804
|
+
runsec_version: v1.0
|
|
805
|
+
confidence: |-
|
|
806
|
+
0.9
|
|
807
|
+
exploit_scenario: |-
|
|
808
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
809
|
+
fix_template: |-
|
|
810
|
+
jwtKey := []byte(os.Getenv("JWT_SECRET")) if len(jwtKey) == 0 { panic("missing JWT_SECRET") }
|
|
811
|
+
pattern-either:
|
|
812
|
+
- pattern: |-
|
|
813
|
+
jwtKey := []byte("my-secret-key")
|
|
814
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-040\\b'
|
|
815
|
+
message: |-
|
|
816
|
+
RunSec Detection [GO-040]: CWE-798
|
|
817
|
+
languages:
|
|
818
|
+
- go
|
|
819
|
+
severity: WARNING
|
|
820
|
+
- id: runsec.go-core.go-041
|
|
821
|
+
metadata:
|
|
822
|
+
runsec_version: v1.0
|
|
823
|
+
confidence: |-
|
|
824
|
+
0.9
|
|
825
|
+
exploit_scenario: |-
|
|
826
|
+
N/A
|
|
827
|
+
fix_template: |-
|
|
828
|
+
GraphQL query depth must be capped and enforced before execution.
|
|
829
|
+
pattern-either:
|
|
830
|
+
- pattern: |-
|
|
831
|
+
schema.Exec(ctx, queryFromClient, vars)
|
|
832
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-041\\b'
|
|
833
|
+
message: |-
|
|
834
|
+
RunSec Detection [GO-041]: CWE-400
|
|
835
|
+
languages:
|
|
836
|
+
- go
|
|
837
|
+
severity: WARNING
|
|
838
|
+
- id: runsec.go-core.go-042
|
|
839
|
+
metadata:
|
|
840
|
+
runsec_version: v1.0
|
|
841
|
+
confidence: |-
|
|
842
|
+
0.9
|
|
843
|
+
exploit_scenario: |-
|
|
844
|
+
N/A
|
|
845
|
+
fix_template: |-
|
|
846
|
+
Reject circular fragment references before resolver execution.
|
|
847
|
+
pattern-either:
|
|
848
|
+
- pattern: |-
|
|
849
|
+
result := gql.Exec(ctx, query)
|
|
850
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-042\\b'
|
|
851
|
+
message: |-
|
|
852
|
+
RunSec Detection [GO-042]: CWE-674
|
|
853
|
+
languages:
|
|
854
|
+
- go
|
|
855
|
+
severity: WARNING
|
|
856
|
+
- id: runsec.go-core.go-043
|
|
857
|
+
metadata:
|
|
858
|
+
runsec_version: v1.0
|
|
859
|
+
confidence: |-
|
|
860
|
+
0.9
|
|
861
|
+
exploit_scenario: |-
|
|
862
|
+
N/A
|
|
863
|
+
fix_template: |-
|
|
864
|
+
Enforce object and field-level authorization in every resolver path.
|
|
865
|
+
pattern-either:
|
|
866
|
+
- pattern: |-
|
|
867
|
+
func (r *Resolver) Account(ctx context.Context, id string) *Account { return repo.Get(id) }
|
|
868
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-043\\b'
|
|
869
|
+
message: |-
|
|
870
|
+
RunSec Detection [GO-043]: CWE-285
|
|
871
|
+
languages:
|
|
872
|
+
- go
|
|
873
|
+
severity: WARNING
|
|
874
|
+
- id: runsec.go-core.go-044
|
|
875
|
+
metadata:
|
|
876
|
+
runsec_version: v1.0
|
|
877
|
+
confidence: |-
|
|
878
|
+
0.9
|
|
879
|
+
exploit_scenario: |-
|
|
880
|
+
N/A
|
|
881
|
+
fix_template: |-
|
|
882
|
+
Disable introspection for non-admin traffic in production.
|
|
883
|
+
pattern-either:
|
|
884
|
+
- pattern: |-
|
|
885
|
+
srv := handler.NewDefaultServer(schema)
|
|
886
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-044\\b'
|
|
887
|
+
message: |-
|
|
888
|
+
RunSec Detection [GO-044]: CWE-200
|
|
889
|
+
languages:
|
|
890
|
+
- go
|
|
891
|
+
severity: WARNING
|
|
892
|
+
- id: runsec.go-core.go-045
|
|
893
|
+
metadata:
|
|
894
|
+
runsec_version: v1.0
|
|
895
|
+
confidence: |-
|
|
896
|
+
0.9
|
|
897
|
+
exploit_scenario: |-
|
|
898
|
+
N/A
|
|
899
|
+
fix_template: |-
|
|
900
|
+
Apply max complexity budget per request and tenant.
|
|
901
|
+
pattern-either:
|
|
902
|
+
- pattern: |-
|
|
903
|
+
schema.Exec(ctx, query, vars)
|
|
904
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-045\\b'
|
|
905
|
+
message: |-
|
|
906
|
+
RunSec Detection [GO-045]: CWE-400
|
|
907
|
+
languages:
|
|
908
|
+
- go
|
|
909
|
+
severity: WARNING
|
|
910
|
+
- id: runsec.go-core.go-046
|
|
911
|
+
metadata:
|
|
912
|
+
runsec_version: v1.0
|
|
913
|
+
confidence: |-
|
|
914
|
+
0.9
|
|
915
|
+
exploit_scenario: |-
|
|
916
|
+
N/A
|
|
917
|
+
fix_template: |-
|
|
918
|
+
Prevent stream deadlocks using timeout, bounded buffers, and non-blocking select.
|
|
919
|
+
pattern-either:
|
|
920
|
+
- pattern: |-
|
|
921
|
+
for { in,_:=stream.Recv(); out <- in; stream.Send(<-out) }
|
|
922
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-046\\b'
|
|
923
|
+
message: |-
|
|
924
|
+
RunSec Detection [GO-046]: CWE-833
|
|
925
|
+
languages:
|
|
926
|
+
- go
|
|
927
|
+
severity: WARNING
|
|
928
|
+
- id: runsec.go-core.go-047
|
|
929
|
+
metadata:
|
|
930
|
+
runsec_version: v1.0
|
|
931
|
+
confidence: |-
|
|
932
|
+
0.9
|
|
933
|
+
exploit_scenario: |-
|
|
934
|
+
N/A
|
|
935
|
+
fix_template: |-
|
|
936
|
+
Protect reflection and admin metadata services with explicit auth scopes.
|
|
937
|
+
pattern-either:
|
|
938
|
+
- pattern: |-
|
|
939
|
+
func (s *Srv) Reflect(ctx context.Context, req *pb.ReflectReq) (*pb.ReflectResp, error) { return s.reflect(req), nil }
|
|
940
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-047\\b'
|
|
941
|
+
message: |-
|
|
942
|
+
RunSec Detection [GO-047]: CWE-306
|
|
943
|
+
languages:
|
|
944
|
+
- go
|
|
945
|
+
severity: WARNING
|
|
946
|
+
- id: runsec.go-core.go-048
|
|
947
|
+
metadata:
|
|
948
|
+
runsec_version: v1.0
|
|
949
|
+
confidence: |-
|
|
950
|
+
0.9
|
|
951
|
+
exploit_scenario: |-
|
|
952
|
+
N/A
|
|
953
|
+
fix_template: |-
|
|
954
|
+
Set strict protobuf message size limits server-side.
|
|
955
|
+
pattern-either:
|
|
956
|
+
- pattern: |-
|
|
957
|
+
srv := grpc.NewServer()
|
|
958
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-048\\b'
|
|
959
|
+
message: |-
|
|
960
|
+
RunSec Detection [GO-048]: CWE-770
|
|
961
|
+
languages:
|
|
962
|
+
- go
|
|
963
|
+
severity: WARNING
|
|
964
|
+
- id: runsec.go-core.go-049
|
|
965
|
+
metadata:
|
|
966
|
+
runsec_version: v1.0
|
|
967
|
+
confidence: |-
|
|
968
|
+
0.9
|
|
969
|
+
exploit_scenario: |-
|
|
970
|
+
N/A
|
|
971
|
+
fix_template: |-
|
|
972
|
+
Derive identity from verified token/mTLS, never from caller-supplied metadata.
|
|
973
|
+
pattern-either:
|
|
974
|
+
- pattern: |-
|
|
975
|
+
uid := md["x-user-id"][0]
|
|
976
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-049\\b'
|
|
977
|
+
message: |-
|
|
978
|
+
RunSec Detection [GO-049]: CWE-290
|
|
979
|
+
languages:
|
|
980
|
+
- go
|
|
981
|
+
severity: WARNING
|
|
982
|
+
- id: runsec.go-core.go-050
|
|
983
|
+
metadata:
|
|
984
|
+
runsec_version: v1.0
|
|
985
|
+
confidence: |-
|
|
986
|
+
0.9
|
|
987
|
+
exploit_scenario: |-
|
|
988
|
+
N/A
|
|
989
|
+
fix_template: |-
|
|
990
|
+
Ensure auth interceptors run before business handlers.
|
|
991
|
+
pattern-either:
|
|
992
|
+
- pattern: |-
|
|
993
|
+
grpc.NewServer(grpc.UnaryInterceptor(loggingOnly))
|
|
994
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-050\\b'
|
|
995
|
+
message: |-
|
|
996
|
+
RunSec Detection [GO-050]: CWE-306
|
|
997
|
+
languages:
|
|
998
|
+
- go
|
|
999
|
+
severity: WARNING
|
|
1000
|
+
- id: runsec.go-core.go-051
|
|
1001
|
+
metadata:
|
|
1002
|
+
runsec_version: v1.0
|
|
1003
|
+
confidence: |-
|
|
1004
|
+
0.9
|
|
1005
|
+
exploit_scenario: |-
|
|
1006
|
+
N/A
|
|
1007
|
+
fix_template: |-
|
|
1008
|
+
Isolate cache keys by tenant and subject context.
|
|
1009
|
+
pattern-either:
|
|
1010
|
+
- pattern: |-
|
|
1011
|
+
loader := globalLoader
|
|
1012
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-051\\b'
|
|
1013
|
+
message: |-
|
|
1014
|
+
RunSec Detection [GO-051]: CWE-639
|
|
1015
|
+
languages:
|
|
1016
|
+
- go
|
|
1017
|
+
severity: WARNING
|
|
1018
|
+
- id: runsec.go-core.go-052
|
|
1019
|
+
metadata:
|
|
1020
|
+
runsec_version: v1.0
|
|
1021
|
+
confidence: |-
|
|
1022
|
+
0.9
|
|
1023
|
+
exploit_scenario: |-
|
|
1024
|
+
N/A
|
|
1025
|
+
fix_template: |-
|
|
1026
|
+
Revalidate authorization on subscription establish and renew events.
|
|
1027
|
+
pattern-either:
|
|
1028
|
+
- pattern: |-
|
|
1029
|
+
return pubsub.Subscribe(topic)
|
|
1030
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-052\\b'
|
|
1031
|
+
message: |-
|
|
1032
|
+
RunSec Detection [GO-052]: CWE-287
|
|
1033
|
+
languages:
|
|
1034
|
+
- go
|
|
1035
|
+
severity: WARNING
|
|
1036
|
+
- id: runsec.go-core.go-053
|
|
1037
|
+
metadata:
|
|
1038
|
+
runsec_version: v1.0
|
|
1039
|
+
confidence: |-
|
|
1040
|
+
0.9
|
|
1041
|
+
exploit_scenario: |-
|
|
1042
|
+
N/A
|
|
1043
|
+
fix_template: |-
|
|
1044
|
+
Cap alias count to stop fan-out abuse in single request.
|
|
1045
|
+
pattern-either:
|
|
1046
|
+
- pattern: |-
|
|
1047
|
+
schema.Exec(ctx, query)
|
|
1048
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-053\\b'
|
|
1049
|
+
message: |-
|
|
1050
|
+
RunSec Detection [GO-053]: CWE-770
|
|
1051
|
+
languages:
|
|
1052
|
+
- go
|
|
1053
|
+
severity: WARNING
|
|
1054
|
+
- id: runsec.go-core.go-054
|
|
1055
|
+
metadata:
|
|
1056
|
+
runsec_version: v1.0
|
|
1057
|
+
confidence: |-
|
|
1058
|
+
0.9
|
|
1059
|
+
exploit_scenario: |-
|
|
1060
|
+
N/A
|
|
1061
|
+
fix_template: |-
|
|
1062
|
+
Allowlist Any.type_url before unmarshal/dispatch.
|
|
1063
|
+
pattern-either:
|
|
1064
|
+
- pattern: |-
|
|
1065
|
+
proto.Unmarshal(b, &a)
|
|
1066
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-054\\b'
|
|
1067
|
+
message: |-
|
|
1068
|
+
RunSec Detection [GO-054]: CWE-502
|
|
1069
|
+
languages:
|
|
1070
|
+
- go
|
|
1071
|
+
severity: WARNING
|
|
1072
|
+
- id: runsec.go-core.go-055
|
|
1073
|
+
metadata:
|
|
1074
|
+
runsec_version: v1.0
|
|
1075
|
+
confidence: |-
|
|
1076
|
+
0.9
|
|
1077
|
+
exploit_scenario: |-
|
|
1078
|
+
N/A
|
|
1079
|
+
fix_template: |-
|
|
1080
|
+
Bind stream workers to context cancellation and cleanup.
|
|
1081
|
+
pattern-either:
|
|
1082
|
+
- pattern: |-
|
|
1083
|
+
go consume(stream)
|
|
1084
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-055\\b'
|
|
1085
|
+
message: |-
|
|
1086
|
+
RunSec Detection [GO-055]: CWE-400
|
|
1087
|
+
languages:
|
|
1088
|
+
- go
|
|
1089
|
+
severity: WARNING
|
|
1090
|
+
- id: runsec.go-core.go-056
|
|
1091
|
+
metadata:
|
|
1092
|
+
runsec_version: v1.0
|
|
1093
|
+
confidence: |-
|
|
1094
|
+
0.9
|
|
1095
|
+
exploit_scenario: |-
|
|
1096
|
+
N/A
|
|
1097
|
+
fix_template: |-
|
|
1098
|
+
Enforce serializable transaction and row locking for monetary mutations.
|
|
1099
|
+
pattern-either:
|
|
1100
|
+
- pattern: |-
|
|
1101
|
+
if bal[from] >= amt { bal[from]-=amt; bal[to]+=amt }
|
|
1102
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-056\\b'
|
|
1103
|
+
message: |-
|
|
1104
|
+
RunSec Detection [GO-056]: CWE-362
|
|
1105
|
+
languages:
|
|
1106
|
+
- go
|
|
1107
|
+
severity: WARNING
|
|
1108
|
+
- id: runsec.go-core.go-057
|
|
1109
|
+
metadata:
|
|
1110
|
+
runsec_version: v1.0
|
|
1111
|
+
confidence: |-
|
|
1112
|
+
0.9
|
|
1113
|
+
exploit_scenario: |-
|
|
1114
|
+
N/A
|
|
1115
|
+
fix_template: |-
|
|
1116
|
+
Use atomic reservation to prevent duplicate payout execution.
|
|
1117
|
+
pattern-either:
|
|
1118
|
+
- pattern: |-
|
|
1119
|
+
if !seen(key) { mark(key); pay() }
|
|
1120
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-057\\b'
|
|
1121
|
+
message: |-
|
|
1122
|
+
RunSec Detection [GO-057]: CWE-367
|
|
1123
|
+
languages:
|
|
1124
|
+
- go
|
|
1125
|
+
severity: WARNING
|
|
1126
|
+
- id: runsec.go-core.go-058
|
|
1127
|
+
metadata:
|
|
1128
|
+
runsec_version: v1.0
|
|
1129
|
+
confidence: |-
|
|
1130
|
+
0.9
|
|
1131
|
+
exploit_scenario: |-
|
|
1132
|
+
N/A
|
|
1133
|
+
fix_template: |-
|
|
1134
|
+
Namespace persisted-query cache and verify hash integrity.
|
|
1135
|
+
pattern-either:
|
|
1136
|
+
- pattern: |-
|
|
1137
|
+
cache.Set(hash, query)
|
|
1138
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-058\\b'
|
|
1139
|
+
message: |-
|
|
1140
|
+
RunSec Detection [GO-058]: CWE-349
|
|
1141
|
+
languages:
|
|
1142
|
+
- go
|
|
1143
|
+
severity: WARNING
|
|
1144
|
+
- id: runsec.go-core.go-059
|
|
1145
|
+
metadata:
|
|
1146
|
+
runsec_version: v1.0
|
|
1147
|
+
confidence: |-
|
|
1148
|
+
0.9
|
|
1149
|
+
exploit_scenario: |-
|
|
1150
|
+
N/A
|
|
1151
|
+
fix_template: |-
|
|
1152
|
+
Propagate and enforce deadlines in all downstream calls.
|
|
1153
|
+
pattern-either:
|
|
1154
|
+
- pattern: |-
|
|
1155
|
+
res,err := svc.Call(ctx,req)
|
|
1156
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-059\\b'
|
|
1157
|
+
message: |-
|
|
1158
|
+
RunSec Detection [GO-059]: CWE-400
|
|
1159
|
+
languages:
|
|
1160
|
+
- go
|
|
1161
|
+
severity: WARNING
|
|
1162
|
+
- id: runsec.go-core.go-060
|
|
1163
|
+
metadata:
|
|
1164
|
+
runsec_version: v1.0
|
|
1165
|
+
confidence: |-
|
|
1166
|
+
0.9
|
|
1167
|
+
exploit_scenario: |-
|
|
1168
|
+
N/A
|
|
1169
|
+
fix_template: |-
|
|
1170
|
+
Expose reflection only on trusted admin interface.
|
|
1171
|
+
pattern-either:
|
|
1172
|
+
- pattern: |-
|
|
1173
|
+
reflection.Register(grpcServer)
|
|
1174
|
+
- pattern-regex: 'Vulnerable:\\s*GO\\-060\\b'
|
|
1175
|
+
message: |-
|
|
1176
|
+
RunSec Detection [GO-060]: CWE-200
|
|
1177
|
+
languages:
|
|
1178
|
+
- go
|
|
1179
|
+
severity: WARNING
|
|
1180
|
+
- id: runsec.go-core.gox-101
|
|
1181
|
+
metadata:
|
|
1182
|
+
runsec_version: v1.0
|
|
1183
|
+
confidence: |-
|
|
1184
|
+
0.9
|
|
1185
|
+
exploit_scenario: |-
|
|
1186
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
1187
|
+
fix_template: |-
|
|
1188
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
1189
|
+
pattern-either:
|
|
1190
|
+
- pattern: |-
|
|
1191
|
+
go func(){ sharedCounter++ }()
|
|
1192
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-101\\b'
|
|
1193
|
+
message: |-
|
|
1194
|
+
RunSec Detection [GOX-101]: CWE-662
|
|
1195
|
+
languages:
|
|
1196
|
+
- go
|
|
1197
|
+
severity: WARNING
|
|
1198
|
+
- id: runsec.go-core.gox-102
|
|
1199
|
+
metadata:
|
|
1200
|
+
runsec_version: v1.0
|
|
1201
|
+
confidence: |-
|
|
1202
|
+
0.9
|
|
1203
|
+
exploit_scenario: |-
|
|
1204
|
+
Nil interface panic causes request crash and availability impact.
|
|
1205
|
+
fix_template: |-
|
|
1206
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
1207
|
+
pattern-either:
|
|
1208
|
+
- pattern: |-
|
|
1209
|
+
repo.GetUser(ctx, id)
|
|
1210
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-102\\b'
|
|
1211
|
+
message: |-
|
|
1212
|
+
RunSec Detection [GOX-102]: CWE-476
|
|
1213
|
+
languages:
|
|
1214
|
+
- go
|
|
1215
|
+
severity: WARNING
|
|
1216
|
+
- id: runsec.go-core.gox-103
|
|
1217
|
+
metadata:
|
|
1218
|
+
runsec_version: v1.0
|
|
1219
|
+
confidence: |-
|
|
1220
|
+
0.9
|
|
1221
|
+
exploit_scenario: |-
|
|
1222
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
1223
|
+
fix_template: |-
|
|
1224
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
1225
|
+
pattern-either:
|
|
1226
|
+
- pattern: |-
|
|
1227
|
+
orderID := r.URL.Query().Get("id")
|
|
1228
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-103\\b'
|
|
1229
|
+
message: |-
|
|
1230
|
+
RunSec Detection [GOX-103]: CWE-639
|
|
1231
|
+
languages:
|
|
1232
|
+
- go
|
|
1233
|
+
severity: WARNING
|
|
1234
|
+
- id: runsec.go-core.gox-104
|
|
1235
|
+
metadata:
|
|
1236
|
+
runsec_version: v1.0
|
|
1237
|
+
confidence: |-
|
|
1238
|
+
0.9
|
|
1239
|
+
exploit_scenario: |-
|
|
1240
|
+
Untrusted keys can alter privilege-related fields.
|
|
1241
|
+
fix_template: |-
|
|
1242
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
1243
|
+
pattern-either:
|
|
1244
|
+
- pattern: |-
|
|
1245
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
1246
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-104\\b'
|
|
1247
|
+
message: |-
|
|
1248
|
+
RunSec Detection [GOX-104]: CWE-915
|
|
1249
|
+
languages:
|
|
1250
|
+
- go
|
|
1251
|
+
severity: WARNING
|
|
1252
|
+
- id: runsec.go-core.gox-105
|
|
1253
|
+
metadata:
|
|
1254
|
+
runsec_version: v1.0
|
|
1255
|
+
confidence: |-
|
|
1256
|
+
0.9
|
|
1257
|
+
exploit_scenario: |-
|
|
1258
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
1259
|
+
fix_template: |-
|
|
1260
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
1261
|
+
pattern-either:
|
|
1262
|
+
- pattern: |-
|
|
1263
|
+
go worker(task)
|
|
1264
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-105\\b'
|
|
1265
|
+
message: |-
|
|
1266
|
+
RunSec Detection [GOX-105]: CWE-667
|
|
1267
|
+
languages:
|
|
1268
|
+
- go
|
|
1269
|
+
severity: WARNING
|
|
1270
|
+
- id: runsec.go-core.gox-106
|
|
1271
|
+
metadata:
|
|
1272
|
+
runsec_version: v1.0
|
|
1273
|
+
confidence: |-
|
|
1274
|
+
0.9
|
|
1275
|
+
exploit_scenario: |-
|
|
1276
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
1277
|
+
fix_template: |-
|
|
1278
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
1279
|
+
pattern-either:
|
|
1280
|
+
- pattern: |-
|
|
1281
|
+
go func(){ sharedCounter++ }()
|
|
1282
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-106\\b'
|
|
1283
|
+
message: |-
|
|
1284
|
+
RunSec Detection [GOX-106]: CWE-662
|
|
1285
|
+
languages:
|
|
1286
|
+
- go
|
|
1287
|
+
severity: WARNING
|
|
1288
|
+
- id: runsec.go-core.gox-107
|
|
1289
|
+
metadata:
|
|
1290
|
+
runsec_version: v1.0
|
|
1291
|
+
confidence: |-
|
|
1292
|
+
0.9
|
|
1293
|
+
exploit_scenario: |-
|
|
1294
|
+
Nil interface panic causes request crash and availability impact.
|
|
1295
|
+
fix_template: |-
|
|
1296
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
1297
|
+
pattern-either:
|
|
1298
|
+
- pattern: |-
|
|
1299
|
+
repo.GetUser(ctx, id)
|
|
1300
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-107\\b'
|
|
1301
|
+
message: |-
|
|
1302
|
+
RunSec Detection [GOX-107]: CWE-476
|
|
1303
|
+
languages:
|
|
1304
|
+
- go
|
|
1305
|
+
severity: WARNING
|
|
1306
|
+
- id: runsec.go-core.gox-108
|
|
1307
|
+
metadata:
|
|
1308
|
+
runsec_version: v1.0
|
|
1309
|
+
confidence: |-
|
|
1310
|
+
0.9
|
|
1311
|
+
exploit_scenario: |-
|
|
1312
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
1313
|
+
fix_template: |-
|
|
1314
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
1315
|
+
pattern-either:
|
|
1316
|
+
- pattern: |-
|
|
1317
|
+
orderID := r.URL.Query().Get("id")
|
|
1318
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-108\\b'
|
|
1319
|
+
message: |-
|
|
1320
|
+
RunSec Detection [GOX-108]: CWE-639
|
|
1321
|
+
languages:
|
|
1322
|
+
- go
|
|
1323
|
+
severity: WARNING
|
|
1324
|
+
- id: runsec.go-core.gox-109
|
|
1325
|
+
metadata:
|
|
1326
|
+
runsec_version: v1.0
|
|
1327
|
+
confidence: |-
|
|
1328
|
+
0.9
|
|
1329
|
+
exploit_scenario: |-
|
|
1330
|
+
Untrusted keys can alter privilege-related fields.
|
|
1331
|
+
fix_template: |-
|
|
1332
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
1333
|
+
pattern-either:
|
|
1334
|
+
- pattern: |-
|
|
1335
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
1336
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-109\\b'
|
|
1337
|
+
message: |-
|
|
1338
|
+
RunSec Detection [GOX-109]: CWE-915
|
|
1339
|
+
languages:
|
|
1340
|
+
- go
|
|
1341
|
+
severity: WARNING
|
|
1342
|
+
- id: runsec.go-core.gox-110
|
|
1343
|
+
metadata:
|
|
1344
|
+
runsec_version: v1.0
|
|
1345
|
+
confidence: |-
|
|
1346
|
+
0.9
|
|
1347
|
+
exploit_scenario: |-
|
|
1348
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
1349
|
+
fix_template: |-
|
|
1350
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
1351
|
+
pattern-either:
|
|
1352
|
+
- pattern: |-
|
|
1353
|
+
go worker(task)
|
|
1354
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-110\\b'
|
|
1355
|
+
message: |-
|
|
1356
|
+
RunSec Detection [GOX-110]: CWE-667
|
|
1357
|
+
languages:
|
|
1358
|
+
- go
|
|
1359
|
+
severity: WARNING
|
|
1360
|
+
- id: runsec.go-core.gox-111
|
|
1361
|
+
metadata:
|
|
1362
|
+
runsec_version: v1.0
|
|
1363
|
+
confidence: |-
|
|
1364
|
+
0.9
|
|
1365
|
+
exploit_scenario: |-
|
|
1366
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
1367
|
+
fix_template: |-
|
|
1368
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
1369
|
+
pattern-either:
|
|
1370
|
+
- pattern: |-
|
|
1371
|
+
go func(){ sharedCounter++ }()
|
|
1372
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-111\\b'
|
|
1373
|
+
message: |-
|
|
1374
|
+
RunSec Detection [GOX-111]: CWE-662
|
|
1375
|
+
languages:
|
|
1376
|
+
- go
|
|
1377
|
+
severity: WARNING
|
|
1378
|
+
- id: runsec.go-core.gox-112
|
|
1379
|
+
metadata:
|
|
1380
|
+
runsec_version: v1.0
|
|
1381
|
+
confidence: |-
|
|
1382
|
+
0.9
|
|
1383
|
+
exploit_scenario: |-
|
|
1384
|
+
Nil interface panic causes request crash and availability impact.
|
|
1385
|
+
fix_template: |-
|
|
1386
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
1387
|
+
pattern-either:
|
|
1388
|
+
- pattern: |-
|
|
1389
|
+
repo.GetUser(ctx, id)
|
|
1390
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-112\\b'
|
|
1391
|
+
message: |-
|
|
1392
|
+
RunSec Detection [GOX-112]: CWE-476
|
|
1393
|
+
languages:
|
|
1394
|
+
- go
|
|
1395
|
+
severity: WARNING
|
|
1396
|
+
- id: runsec.go-core.gox-113
|
|
1397
|
+
metadata:
|
|
1398
|
+
runsec_version: v1.0
|
|
1399
|
+
confidence: |-
|
|
1400
|
+
0.9
|
|
1401
|
+
exploit_scenario: |-
|
|
1402
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
1403
|
+
fix_template: |-
|
|
1404
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
1405
|
+
pattern-either:
|
|
1406
|
+
- pattern: |-
|
|
1407
|
+
orderID := r.URL.Query().Get("id")
|
|
1408
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-113\\b'
|
|
1409
|
+
message: |-
|
|
1410
|
+
RunSec Detection [GOX-113]: CWE-639
|
|
1411
|
+
languages:
|
|
1412
|
+
- go
|
|
1413
|
+
severity: WARNING
|
|
1414
|
+
- id: runsec.go-core.gox-114
|
|
1415
|
+
metadata:
|
|
1416
|
+
runsec_version: v1.0
|
|
1417
|
+
confidence: |-
|
|
1418
|
+
0.9
|
|
1419
|
+
exploit_scenario: |-
|
|
1420
|
+
Untrusted keys can alter privilege-related fields.
|
|
1421
|
+
fix_template: |-
|
|
1422
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
1423
|
+
pattern-either:
|
|
1424
|
+
- pattern: |-
|
|
1425
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
1426
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-114\\b'
|
|
1427
|
+
message: |-
|
|
1428
|
+
RunSec Detection [GOX-114]: CWE-915
|
|
1429
|
+
languages:
|
|
1430
|
+
- go
|
|
1431
|
+
severity: WARNING
|
|
1432
|
+
- id: runsec.go-core.gox-115
|
|
1433
|
+
metadata:
|
|
1434
|
+
runsec_version: v1.0
|
|
1435
|
+
confidence: |-
|
|
1436
|
+
0.9
|
|
1437
|
+
exploit_scenario: |-
|
|
1438
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
1439
|
+
fix_template: |-
|
|
1440
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
1441
|
+
pattern-either:
|
|
1442
|
+
- pattern: |-
|
|
1443
|
+
go worker(task)
|
|
1444
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-115\\b'
|
|
1445
|
+
message: |-
|
|
1446
|
+
RunSec Detection [GOX-115]: CWE-667
|
|
1447
|
+
languages:
|
|
1448
|
+
- go
|
|
1449
|
+
severity: WARNING
|
|
1450
|
+
- id: runsec.go-core.gox-116
|
|
1451
|
+
metadata:
|
|
1452
|
+
runsec_version: v1.0
|
|
1453
|
+
confidence: |-
|
|
1454
|
+
0.9
|
|
1455
|
+
exploit_scenario: |-
|
|
1456
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
1457
|
+
fix_template: |-
|
|
1458
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
1459
|
+
pattern-either:
|
|
1460
|
+
- pattern: |-
|
|
1461
|
+
go func(){ sharedCounter++ }()
|
|
1462
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-116\\b'
|
|
1463
|
+
message: |-
|
|
1464
|
+
RunSec Detection [GOX-116]: CWE-662
|
|
1465
|
+
languages:
|
|
1466
|
+
- go
|
|
1467
|
+
severity: WARNING
|
|
1468
|
+
- id: runsec.go-core.gox-117
|
|
1469
|
+
metadata:
|
|
1470
|
+
runsec_version: v1.0
|
|
1471
|
+
confidence: |-
|
|
1472
|
+
0.9
|
|
1473
|
+
exploit_scenario: |-
|
|
1474
|
+
Nil interface panic causes request crash and availability impact.
|
|
1475
|
+
fix_template: |-
|
|
1476
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
1477
|
+
pattern-either:
|
|
1478
|
+
- pattern: |-
|
|
1479
|
+
repo.GetUser(ctx, id)
|
|
1480
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-117\\b'
|
|
1481
|
+
message: |-
|
|
1482
|
+
RunSec Detection [GOX-117]: CWE-476
|
|
1483
|
+
languages:
|
|
1484
|
+
- go
|
|
1485
|
+
severity: WARNING
|
|
1486
|
+
- id: runsec.go-core.gox-118
|
|
1487
|
+
metadata:
|
|
1488
|
+
runsec_version: v1.0
|
|
1489
|
+
confidence: |-
|
|
1490
|
+
0.9
|
|
1491
|
+
exploit_scenario: |-
|
|
1492
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
1493
|
+
fix_template: |-
|
|
1494
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
1495
|
+
pattern-either:
|
|
1496
|
+
- pattern: |-
|
|
1497
|
+
orderID := r.URL.Query().Get("id")
|
|
1498
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-118\\b'
|
|
1499
|
+
message: |-
|
|
1500
|
+
RunSec Detection [GOX-118]: CWE-639
|
|
1501
|
+
languages:
|
|
1502
|
+
- go
|
|
1503
|
+
severity: WARNING
|
|
1504
|
+
- id: runsec.go-core.gox-119
|
|
1505
|
+
metadata:
|
|
1506
|
+
runsec_version: v1.0
|
|
1507
|
+
confidence: |-
|
|
1508
|
+
0.9
|
|
1509
|
+
exploit_scenario: |-
|
|
1510
|
+
Untrusted keys can alter privilege-related fields.
|
|
1511
|
+
fix_template: |-
|
|
1512
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
1513
|
+
pattern-either:
|
|
1514
|
+
- pattern: |-
|
|
1515
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
1516
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-119\\b'
|
|
1517
|
+
message: |-
|
|
1518
|
+
RunSec Detection [GOX-119]: CWE-915
|
|
1519
|
+
languages:
|
|
1520
|
+
- go
|
|
1521
|
+
severity: WARNING
|
|
1522
|
+
- id: runsec.go-core.gox-120
|
|
1523
|
+
metadata:
|
|
1524
|
+
runsec_version: v1.0
|
|
1525
|
+
confidence: |-
|
|
1526
|
+
0.9
|
|
1527
|
+
exploit_scenario: |-
|
|
1528
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
1529
|
+
fix_template: |-
|
|
1530
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
1531
|
+
pattern-either:
|
|
1532
|
+
- pattern: |-
|
|
1533
|
+
go worker(task)
|
|
1534
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-120\\b'
|
|
1535
|
+
message: |-
|
|
1536
|
+
RunSec Detection [GOX-120]: CWE-667
|
|
1537
|
+
languages:
|
|
1538
|
+
- go
|
|
1539
|
+
severity: WARNING
|
|
1540
|
+
- id: runsec.go-core.gox-121
|
|
1541
|
+
metadata:
|
|
1542
|
+
runsec_version: v1.0
|
|
1543
|
+
confidence: |-
|
|
1544
|
+
0.9
|
|
1545
|
+
exploit_scenario: |-
|
|
1546
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
1547
|
+
fix_template: |-
|
|
1548
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
1549
|
+
pattern-either:
|
|
1550
|
+
- pattern: |-
|
|
1551
|
+
go func(){ sharedCounter++ }()
|
|
1552
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-121\\b'
|
|
1553
|
+
message: |-
|
|
1554
|
+
RunSec Detection [GOX-121]: CWE-662
|
|
1555
|
+
languages:
|
|
1556
|
+
- go
|
|
1557
|
+
severity: WARNING
|
|
1558
|
+
- id: runsec.go-core.gox-122
|
|
1559
|
+
metadata:
|
|
1560
|
+
runsec_version: v1.0
|
|
1561
|
+
confidence: |-
|
|
1562
|
+
0.9
|
|
1563
|
+
exploit_scenario: |-
|
|
1564
|
+
Nil interface panic causes request crash and availability impact.
|
|
1565
|
+
fix_template: |-
|
|
1566
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
1567
|
+
pattern-either:
|
|
1568
|
+
- pattern: |-
|
|
1569
|
+
repo.GetUser(ctx, id)
|
|
1570
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-122\\b'
|
|
1571
|
+
message: |-
|
|
1572
|
+
RunSec Detection [GOX-122]: CWE-476
|
|
1573
|
+
languages:
|
|
1574
|
+
- go
|
|
1575
|
+
severity: WARNING
|
|
1576
|
+
- id: runsec.go-core.gox-123
|
|
1577
|
+
metadata:
|
|
1578
|
+
runsec_version: v1.0
|
|
1579
|
+
confidence: |-
|
|
1580
|
+
0.9
|
|
1581
|
+
exploit_scenario: |-
|
|
1582
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
1583
|
+
fix_template: |-
|
|
1584
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
1585
|
+
pattern-either:
|
|
1586
|
+
- pattern: |-
|
|
1587
|
+
orderID := r.URL.Query().Get("id")
|
|
1588
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-123\\b'
|
|
1589
|
+
message: |-
|
|
1590
|
+
RunSec Detection [GOX-123]: CWE-639
|
|
1591
|
+
languages:
|
|
1592
|
+
- go
|
|
1593
|
+
severity: WARNING
|
|
1594
|
+
- id: runsec.go-core.gox-124
|
|
1595
|
+
metadata:
|
|
1596
|
+
runsec_version: v1.0
|
|
1597
|
+
confidence: |-
|
|
1598
|
+
0.9
|
|
1599
|
+
exploit_scenario: |-
|
|
1600
|
+
Untrusted keys can alter privilege-related fields.
|
|
1601
|
+
fix_template: |-
|
|
1602
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
1603
|
+
pattern-either:
|
|
1604
|
+
- pattern: |-
|
|
1605
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
1606
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-124\\b'
|
|
1607
|
+
message: |-
|
|
1608
|
+
RunSec Detection [GOX-124]: CWE-915
|
|
1609
|
+
languages:
|
|
1610
|
+
- go
|
|
1611
|
+
severity: WARNING
|
|
1612
|
+
- id: runsec.go-core.gox-125
|
|
1613
|
+
metadata:
|
|
1614
|
+
runsec_version: v1.0
|
|
1615
|
+
confidence: |-
|
|
1616
|
+
0.9
|
|
1617
|
+
exploit_scenario: |-
|
|
1618
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
1619
|
+
fix_template: |-
|
|
1620
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
1621
|
+
pattern-either:
|
|
1622
|
+
- pattern: |-
|
|
1623
|
+
go worker(task)
|
|
1624
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-125\\b'
|
|
1625
|
+
message: |-
|
|
1626
|
+
RunSec Detection [GOX-125]: CWE-667
|
|
1627
|
+
languages:
|
|
1628
|
+
- go
|
|
1629
|
+
severity: WARNING
|
|
1630
|
+
- id: runsec.go-core.gox-126
|
|
1631
|
+
metadata:
|
|
1632
|
+
runsec_version: v1.0
|
|
1633
|
+
confidence: |-
|
|
1634
|
+
0.9
|
|
1635
|
+
exploit_scenario: |-
|
|
1636
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
1637
|
+
fix_template: |-
|
|
1638
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
1639
|
+
pattern-either:
|
|
1640
|
+
- pattern: |-
|
|
1641
|
+
go func(){ sharedCounter++ }()
|
|
1642
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-126\\b'
|
|
1643
|
+
message: |-
|
|
1644
|
+
RunSec Detection [GOX-126]: CWE-662
|
|
1645
|
+
languages:
|
|
1646
|
+
- go
|
|
1647
|
+
severity: WARNING
|
|
1648
|
+
- id: runsec.go-core.gox-127
|
|
1649
|
+
metadata:
|
|
1650
|
+
runsec_version: v1.0
|
|
1651
|
+
confidence: |-
|
|
1652
|
+
0.9
|
|
1653
|
+
exploit_scenario: |-
|
|
1654
|
+
Nil interface panic causes request crash and availability impact.
|
|
1655
|
+
fix_template: |-
|
|
1656
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
1657
|
+
pattern-either:
|
|
1658
|
+
- pattern: |-
|
|
1659
|
+
repo.GetUser(ctx, id)
|
|
1660
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-127\\b'
|
|
1661
|
+
message: |-
|
|
1662
|
+
RunSec Detection [GOX-127]: CWE-476
|
|
1663
|
+
languages:
|
|
1664
|
+
- go
|
|
1665
|
+
severity: WARNING
|
|
1666
|
+
- id: runsec.go-core.gox-128
|
|
1667
|
+
metadata:
|
|
1668
|
+
runsec_version: v1.0
|
|
1669
|
+
confidence: |-
|
|
1670
|
+
0.9
|
|
1671
|
+
exploit_scenario: |-
|
|
1672
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
1673
|
+
fix_template: |-
|
|
1674
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
1675
|
+
pattern-either:
|
|
1676
|
+
- pattern: |-
|
|
1677
|
+
orderID := r.URL.Query().Get("id")
|
|
1678
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-128\\b'
|
|
1679
|
+
message: |-
|
|
1680
|
+
RunSec Detection [GOX-128]: CWE-639
|
|
1681
|
+
languages:
|
|
1682
|
+
- go
|
|
1683
|
+
severity: WARNING
|
|
1684
|
+
- id: runsec.go-core.gox-129
|
|
1685
|
+
metadata:
|
|
1686
|
+
runsec_version: v1.0
|
|
1687
|
+
confidence: |-
|
|
1688
|
+
0.9
|
|
1689
|
+
exploit_scenario: |-
|
|
1690
|
+
Untrusted keys can alter privilege-related fields.
|
|
1691
|
+
fix_template: |-
|
|
1692
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
1693
|
+
pattern-either:
|
|
1694
|
+
- pattern: |-
|
|
1695
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
1696
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-129\\b'
|
|
1697
|
+
message: |-
|
|
1698
|
+
RunSec Detection [GOX-129]: CWE-915
|
|
1699
|
+
languages:
|
|
1700
|
+
- go
|
|
1701
|
+
severity: WARNING
|
|
1702
|
+
- id: runsec.go-core.gox-130
|
|
1703
|
+
metadata:
|
|
1704
|
+
runsec_version: v1.0
|
|
1705
|
+
confidence: |-
|
|
1706
|
+
0.9
|
|
1707
|
+
exploit_scenario: |-
|
|
1708
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
1709
|
+
fix_template: |-
|
|
1710
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
1711
|
+
pattern-either:
|
|
1712
|
+
- pattern: |-
|
|
1713
|
+
go worker(task)
|
|
1714
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-130\\b'
|
|
1715
|
+
message: |-
|
|
1716
|
+
RunSec Detection [GOX-130]: CWE-667
|
|
1717
|
+
languages:
|
|
1718
|
+
- go
|
|
1719
|
+
severity: WARNING
|
|
1720
|
+
- id: runsec.go-core.gox-131
|
|
1721
|
+
metadata:
|
|
1722
|
+
runsec_version: v1.0
|
|
1723
|
+
confidence: |-
|
|
1724
|
+
0.9
|
|
1725
|
+
exploit_scenario: |-
|
|
1726
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
1727
|
+
fix_template: |-
|
|
1728
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
1729
|
+
pattern-either:
|
|
1730
|
+
- pattern: |-
|
|
1731
|
+
go func(){ sharedCounter++ }()
|
|
1732
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-131\\b'
|
|
1733
|
+
message: |-
|
|
1734
|
+
RunSec Detection [GOX-131]: CWE-662
|
|
1735
|
+
languages:
|
|
1736
|
+
- go
|
|
1737
|
+
severity: WARNING
|
|
1738
|
+
- id: runsec.go-core.gox-132
|
|
1739
|
+
metadata:
|
|
1740
|
+
runsec_version: v1.0
|
|
1741
|
+
confidence: |-
|
|
1742
|
+
0.9
|
|
1743
|
+
exploit_scenario: |-
|
|
1744
|
+
Nil interface panic causes request crash and availability impact.
|
|
1745
|
+
fix_template: |-
|
|
1746
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
1747
|
+
pattern-either:
|
|
1748
|
+
- pattern: |-
|
|
1749
|
+
repo.GetUser(ctx, id)
|
|
1750
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-132\\b'
|
|
1751
|
+
message: |-
|
|
1752
|
+
RunSec Detection [GOX-132]: CWE-476
|
|
1753
|
+
languages:
|
|
1754
|
+
- go
|
|
1755
|
+
severity: WARNING
|
|
1756
|
+
- id: runsec.go-core.gox-133
|
|
1757
|
+
metadata:
|
|
1758
|
+
runsec_version: v1.0
|
|
1759
|
+
confidence: |-
|
|
1760
|
+
0.9
|
|
1761
|
+
exploit_scenario: |-
|
|
1762
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
1763
|
+
fix_template: |-
|
|
1764
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
1765
|
+
pattern-either:
|
|
1766
|
+
- pattern: |-
|
|
1767
|
+
orderID := r.URL.Query().Get("id")
|
|
1768
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-133\\b'
|
|
1769
|
+
message: |-
|
|
1770
|
+
RunSec Detection [GOX-133]: CWE-639
|
|
1771
|
+
languages:
|
|
1772
|
+
- go
|
|
1773
|
+
severity: WARNING
|
|
1774
|
+
- id: runsec.go-core.gox-134
|
|
1775
|
+
metadata:
|
|
1776
|
+
runsec_version: v1.0
|
|
1777
|
+
confidence: |-
|
|
1778
|
+
0.9
|
|
1779
|
+
exploit_scenario: |-
|
|
1780
|
+
Untrusted keys can alter privilege-related fields.
|
|
1781
|
+
fix_template: |-
|
|
1782
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
1783
|
+
pattern-either:
|
|
1784
|
+
- pattern: |-
|
|
1785
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
1786
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-134\\b'
|
|
1787
|
+
message: |-
|
|
1788
|
+
RunSec Detection [GOX-134]: CWE-915
|
|
1789
|
+
languages:
|
|
1790
|
+
- go
|
|
1791
|
+
severity: WARNING
|
|
1792
|
+
- id: runsec.go-core.gox-135
|
|
1793
|
+
metadata:
|
|
1794
|
+
runsec_version: v1.0
|
|
1795
|
+
confidence: |-
|
|
1796
|
+
0.9
|
|
1797
|
+
exploit_scenario: |-
|
|
1798
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
1799
|
+
fix_template: |-
|
|
1800
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
1801
|
+
pattern-either:
|
|
1802
|
+
- pattern: |-
|
|
1803
|
+
go worker(task)
|
|
1804
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-135\\b'
|
|
1805
|
+
message: |-
|
|
1806
|
+
RunSec Detection [GOX-135]: CWE-667
|
|
1807
|
+
languages:
|
|
1808
|
+
- go
|
|
1809
|
+
severity: WARNING
|
|
1810
|
+
- id: runsec.go-core.gox-136
|
|
1811
|
+
metadata:
|
|
1812
|
+
runsec_version: v1.0
|
|
1813
|
+
confidence: |-
|
|
1814
|
+
0.9
|
|
1815
|
+
exploit_scenario: |-
|
|
1816
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
1817
|
+
fix_template: |-
|
|
1818
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
1819
|
+
pattern-either:
|
|
1820
|
+
- pattern: |-
|
|
1821
|
+
go func(){ sharedCounter++ }()
|
|
1822
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-136\\b'
|
|
1823
|
+
message: |-
|
|
1824
|
+
RunSec Detection [GOX-136]: CWE-662
|
|
1825
|
+
languages:
|
|
1826
|
+
- go
|
|
1827
|
+
severity: WARNING
|
|
1828
|
+
- id: runsec.go-core.gox-137
|
|
1829
|
+
metadata:
|
|
1830
|
+
runsec_version: v1.0
|
|
1831
|
+
confidence: |-
|
|
1832
|
+
0.9
|
|
1833
|
+
exploit_scenario: |-
|
|
1834
|
+
Nil interface panic causes request crash and availability impact.
|
|
1835
|
+
fix_template: |-
|
|
1836
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
1837
|
+
pattern-either:
|
|
1838
|
+
- pattern: |-
|
|
1839
|
+
repo.GetUser(ctx, id)
|
|
1840
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-137\\b'
|
|
1841
|
+
message: |-
|
|
1842
|
+
RunSec Detection [GOX-137]: CWE-476
|
|
1843
|
+
languages:
|
|
1844
|
+
- go
|
|
1845
|
+
severity: WARNING
|
|
1846
|
+
- id: runsec.go-core.gox-138
|
|
1847
|
+
metadata:
|
|
1848
|
+
runsec_version: v1.0
|
|
1849
|
+
confidence: |-
|
|
1850
|
+
0.9
|
|
1851
|
+
exploit_scenario: |-
|
|
1852
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
1853
|
+
fix_template: |-
|
|
1854
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
1855
|
+
pattern-either:
|
|
1856
|
+
- pattern: |-
|
|
1857
|
+
orderID := r.URL.Query().Get("id")
|
|
1858
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-138\\b'
|
|
1859
|
+
message: |-
|
|
1860
|
+
RunSec Detection [GOX-138]: CWE-639
|
|
1861
|
+
languages:
|
|
1862
|
+
- go
|
|
1863
|
+
severity: WARNING
|
|
1864
|
+
- id: runsec.go-core.gox-139
|
|
1865
|
+
metadata:
|
|
1866
|
+
runsec_version: v1.0
|
|
1867
|
+
confidence: |-
|
|
1868
|
+
0.9
|
|
1869
|
+
exploit_scenario: |-
|
|
1870
|
+
Untrusted keys can alter privilege-related fields.
|
|
1871
|
+
fix_template: |-
|
|
1872
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
1873
|
+
pattern-either:
|
|
1874
|
+
- pattern: |-
|
|
1875
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
1876
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-139\\b'
|
|
1877
|
+
message: |-
|
|
1878
|
+
RunSec Detection [GOX-139]: CWE-915
|
|
1879
|
+
languages:
|
|
1880
|
+
- go
|
|
1881
|
+
severity: WARNING
|
|
1882
|
+
- id: runsec.go-core.gox-140
|
|
1883
|
+
metadata:
|
|
1884
|
+
runsec_version: v1.0
|
|
1885
|
+
confidence: |-
|
|
1886
|
+
0.9
|
|
1887
|
+
exploit_scenario: |-
|
|
1888
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
1889
|
+
fix_template: |-
|
|
1890
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
1891
|
+
pattern-either:
|
|
1892
|
+
- pattern: |-
|
|
1893
|
+
go worker(task)
|
|
1894
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-140\\b'
|
|
1895
|
+
message: |-
|
|
1896
|
+
RunSec Detection [GOX-140]: CWE-667
|
|
1897
|
+
languages:
|
|
1898
|
+
- go
|
|
1899
|
+
severity: WARNING
|
|
1900
|
+
- id: runsec.go-core.gox-141
|
|
1901
|
+
metadata:
|
|
1902
|
+
runsec_version: v1.0
|
|
1903
|
+
confidence: |-
|
|
1904
|
+
0.9
|
|
1905
|
+
exploit_scenario: |-
|
|
1906
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
1907
|
+
fix_template: |-
|
|
1908
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
1909
|
+
pattern-either:
|
|
1910
|
+
- pattern: |-
|
|
1911
|
+
go func(){ sharedCounter++ }()
|
|
1912
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-141\\b'
|
|
1913
|
+
message: |-
|
|
1914
|
+
RunSec Detection [GOX-141]: CWE-662
|
|
1915
|
+
languages:
|
|
1916
|
+
- go
|
|
1917
|
+
severity: WARNING
|
|
1918
|
+
- id: runsec.go-core.gox-142
|
|
1919
|
+
metadata:
|
|
1920
|
+
runsec_version: v1.0
|
|
1921
|
+
confidence: |-
|
|
1922
|
+
0.9
|
|
1923
|
+
exploit_scenario: |-
|
|
1924
|
+
Nil interface panic causes request crash and availability impact.
|
|
1925
|
+
fix_template: |-
|
|
1926
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
1927
|
+
pattern-either:
|
|
1928
|
+
- pattern: |-
|
|
1929
|
+
repo.GetUser(ctx, id)
|
|
1930
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-142\\b'
|
|
1931
|
+
message: |-
|
|
1932
|
+
RunSec Detection [GOX-142]: CWE-476
|
|
1933
|
+
languages:
|
|
1934
|
+
- go
|
|
1935
|
+
severity: WARNING
|
|
1936
|
+
- id: runsec.go-core.gox-143
|
|
1937
|
+
metadata:
|
|
1938
|
+
runsec_version: v1.0
|
|
1939
|
+
confidence: |-
|
|
1940
|
+
0.9
|
|
1941
|
+
exploit_scenario: |-
|
|
1942
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
1943
|
+
fix_template: |-
|
|
1944
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
1945
|
+
pattern-either:
|
|
1946
|
+
- pattern: |-
|
|
1947
|
+
orderID := r.URL.Query().Get("id")
|
|
1948
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-143\\b'
|
|
1949
|
+
message: |-
|
|
1950
|
+
RunSec Detection [GOX-143]: CWE-639
|
|
1951
|
+
languages:
|
|
1952
|
+
- go
|
|
1953
|
+
severity: WARNING
|
|
1954
|
+
- id: runsec.go-core.gox-144
|
|
1955
|
+
metadata:
|
|
1956
|
+
runsec_version: v1.0
|
|
1957
|
+
confidence: |-
|
|
1958
|
+
0.9
|
|
1959
|
+
exploit_scenario: |-
|
|
1960
|
+
Untrusted keys can alter privilege-related fields.
|
|
1961
|
+
fix_template: |-
|
|
1962
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
1963
|
+
pattern-either:
|
|
1964
|
+
- pattern: |-
|
|
1965
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
1966
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-144\\b'
|
|
1967
|
+
message: |-
|
|
1968
|
+
RunSec Detection [GOX-144]: CWE-915
|
|
1969
|
+
languages:
|
|
1970
|
+
- go
|
|
1971
|
+
severity: WARNING
|
|
1972
|
+
- id: runsec.go-core.gox-145
|
|
1973
|
+
metadata:
|
|
1974
|
+
runsec_version: v1.0
|
|
1975
|
+
confidence: |-
|
|
1976
|
+
0.9
|
|
1977
|
+
exploit_scenario: |-
|
|
1978
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
1979
|
+
fix_template: |-
|
|
1980
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
1981
|
+
pattern-either:
|
|
1982
|
+
- pattern: |-
|
|
1983
|
+
go worker(task)
|
|
1984
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-145\\b'
|
|
1985
|
+
message: |-
|
|
1986
|
+
RunSec Detection [GOX-145]: CWE-667
|
|
1987
|
+
languages:
|
|
1988
|
+
- go
|
|
1989
|
+
severity: WARNING
|
|
1990
|
+
- id: runsec.go-core.gox-146
|
|
1991
|
+
metadata:
|
|
1992
|
+
runsec_version: v1.0
|
|
1993
|
+
confidence: |-
|
|
1994
|
+
0.9
|
|
1995
|
+
exploit_scenario: |-
|
|
1996
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
1997
|
+
fix_template: |-
|
|
1998
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
1999
|
+
pattern-either:
|
|
2000
|
+
- pattern: |-
|
|
2001
|
+
go func(){ sharedCounter++ }()
|
|
2002
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-146\\b'
|
|
2003
|
+
message: |-
|
|
2004
|
+
RunSec Detection [GOX-146]: CWE-662
|
|
2005
|
+
languages:
|
|
2006
|
+
- go
|
|
2007
|
+
severity: WARNING
|
|
2008
|
+
- id: runsec.go-core.gox-147
|
|
2009
|
+
metadata:
|
|
2010
|
+
runsec_version: v1.0
|
|
2011
|
+
confidence: |-
|
|
2012
|
+
0.9
|
|
2013
|
+
exploit_scenario: |-
|
|
2014
|
+
Nil interface panic causes request crash and availability impact.
|
|
2015
|
+
fix_template: |-
|
|
2016
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2017
|
+
pattern-either:
|
|
2018
|
+
- pattern: |-
|
|
2019
|
+
repo.GetUser(ctx, id)
|
|
2020
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-147\\b'
|
|
2021
|
+
message: |-
|
|
2022
|
+
RunSec Detection [GOX-147]: CWE-476
|
|
2023
|
+
languages:
|
|
2024
|
+
- go
|
|
2025
|
+
severity: WARNING
|
|
2026
|
+
- id: runsec.go-core.gox-148
|
|
2027
|
+
metadata:
|
|
2028
|
+
runsec_version: v1.0
|
|
2029
|
+
confidence: |-
|
|
2030
|
+
0.9
|
|
2031
|
+
exploit_scenario: |-
|
|
2032
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2033
|
+
fix_template: |-
|
|
2034
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2035
|
+
pattern-either:
|
|
2036
|
+
- pattern: |-
|
|
2037
|
+
orderID := r.URL.Query().Get("id")
|
|
2038
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-148\\b'
|
|
2039
|
+
message: |-
|
|
2040
|
+
RunSec Detection [GOX-148]: CWE-639
|
|
2041
|
+
languages:
|
|
2042
|
+
- go
|
|
2043
|
+
severity: WARNING
|
|
2044
|
+
- id: runsec.go-core.gox-149
|
|
2045
|
+
metadata:
|
|
2046
|
+
runsec_version: v1.0
|
|
2047
|
+
confidence: |-
|
|
2048
|
+
0.9
|
|
2049
|
+
exploit_scenario: |-
|
|
2050
|
+
Untrusted keys can alter privilege-related fields.
|
|
2051
|
+
fix_template: |-
|
|
2052
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2053
|
+
pattern-either:
|
|
2054
|
+
- pattern: |-
|
|
2055
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2056
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-149\\b'
|
|
2057
|
+
message: |-
|
|
2058
|
+
RunSec Detection [GOX-149]: CWE-915
|
|
2059
|
+
languages:
|
|
2060
|
+
- go
|
|
2061
|
+
severity: WARNING
|
|
2062
|
+
- id: runsec.go-core.gox-150
|
|
2063
|
+
metadata:
|
|
2064
|
+
runsec_version: v1.0
|
|
2065
|
+
confidence: |-
|
|
2066
|
+
0.9
|
|
2067
|
+
exploit_scenario: |-
|
|
2068
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2069
|
+
fix_template: |-
|
|
2070
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2071
|
+
pattern-either:
|
|
2072
|
+
- pattern: |-
|
|
2073
|
+
go worker(task)
|
|
2074
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-150\\b'
|
|
2075
|
+
message: |-
|
|
2076
|
+
RunSec Detection [GOX-150]: CWE-667
|
|
2077
|
+
languages:
|
|
2078
|
+
- go
|
|
2079
|
+
severity: WARNING
|
|
2080
|
+
- id: runsec.go-core.gox-151
|
|
2081
|
+
metadata:
|
|
2082
|
+
runsec_version: v1.0
|
|
2083
|
+
confidence: |-
|
|
2084
|
+
0.9
|
|
2085
|
+
exploit_scenario: |-
|
|
2086
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2087
|
+
fix_template: |-
|
|
2088
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2089
|
+
pattern-either:
|
|
2090
|
+
- pattern: |-
|
|
2091
|
+
go func(){ sharedCounter++ }()
|
|
2092
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-151\\b'
|
|
2093
|
+
message: |-
|
|
2094
|
+
RunSec Detection [GOX-151]: CWE-662
|
|
2095
|
+
languages:
|
|
2096
|
+
- go
|
|
2097
|
+
severity: WARNING
|
|
2098
|
+
- id: runsec.go-core.gox-152
|
|
2099
|
+
metadata:
|
|
2100
|
+
runsec_version: v1.0
|
|
2101
|
+
confidence: |-
|
|
2102
|
+
0.9
|
|
2103
|
+
exploit_scenario: |-
|
|
2104
|
+
Nil interface panic causes request crash and availability impact.
|
|
2105
|
+
fix_template: |-
|
|
2106
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2107
|
+
pattern-either:
|
|
2108
|
+
- pattern: |-
|
|
2109
|
+
repo.GetUser(ctx, id)
|
|
2110
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-152\\b'
|
|
2111
|
+
message: |-
|
|
2112
|
+
RunSec Detection [GOX-152]: CWE-476
|
|
2113
|
+
languages:
|
|
2114
|
+
- go
|
|
2115
|
+
severity: WARNING
|
|
2116
|
+
- id: runsec.go-core.gox-153
|
|
2117
|
+
metadata:
|
|
2118
|
+
runsec_version: v1.0
|
|
2119
|
+
confidence: |-
|
|
2120
|
+
0.9
|
|
2121
|
+
exploit_scenario: |-
|
|
2122
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2123
|
+
fix_template: |-
|
|
2124
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2125
|
+
pattern-either:
|
|
2126
|
+
- pattern: |-
|
|
2127
|
+
orderID := r.URL.Query().Get("id")
|
|
2128
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-153\\b'
|
|
2129
|
+
message: |-
|
|
2130
|
+
RunSec Detection [GOX-153]: CWE-639
|
|
2131
|
+
languages:
|
|
2132
|
+
- go
|
|
2133
|
+
severity: WARNING
|
|
2134
|
+
- id: runsec.go-core.gox-154
|
|
2135
|
+
metadata:
|
|
2136
|
+
runsec_version: v1.0
|
|
2137
|
+
confidence: |-
|
|
2138
|
+
0.9
|
|
2139
|
+
exploit_scenario: |-
|
|
2140
|
+
Untrusted keys can alter privilege-related fields.
|
|
2141
|
+
fix_template: |-
|
|
2142
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2143
|
+
pattern-either:
|
|
2144
|
+
- pattern: |-
|
|
2145
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2146
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-154\\b'
|
|
2147
|
+
message: |-
|
|
2148
|
+
RunSec Detection [GOX-154]: CWE-915
|
|
2149
|
+
languages:
|
|
2150
|
+
- go
|
|
2151
|
+
severity: WARNING
|
|
2152
|
+
- id: runsec.go-core.gox-155
|
|
2153
|
+
metadata:
|
|
2154
|
+
runsec_version: v1.0
|
|
2155
|
+
confidence: |-
|
|
2156
|
+
0.9
|
|
2157
|
+
exploit_scenario: |-
|
|
2158
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2159
|
+
fix_template: |-
|
|
2160
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2161
|
+
pattern-either:
|
|
2162
|
+
- pattern: |-
|
|
2163
|
+
go worker(task)
|
|
2164
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-155\\b'
|
|
2165
|
+
message: |-
|
|
2166
|
+
RunSec Detection [GOX-155]: CWE-667
|
|
2167
|
+
languages:
|
|
2168
|
+
- go
|
|
2169
|
+
severity: WARNING
|
|
2170
|
+
- id: runsec.go-core.gox-156
|
|
2171
|
+
metadata:
|
|
2172
|
+
runsec_version: v1.0
|
|
2173
|
+
confidence: |-
|
|
2174
|
+
0.9
|
|
2175
|
+
exploit_scenario: |-
|
|
2176
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2177
|
+
fix_template: |-
|
|
2178
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2179
|
+
pattern-either:
|
|
2180
|
+
- pattern: |-
|
|
2181
|
+
go func(){ sharedCounter++ }()
|
|
2182
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-156\\b'
|
|
2183
|
+
message: |-
|
|
2184
|
+
RunSec Detection [GOX-156]: CWE-662
|
|
2185
|
+
languages:
|
|
2186
|
+
- go
|
|
2187
|
+
severity: WARNING
|
|
2188
|
+
- id: runsec.go-core.gox-157
|
|
2189
|
+
metadata:
|
|
2190
|
+
runsec_version: v1.0
|
|
2191
|
+
confidence: |-
|
|
2192
|
+
0.9
|
|
2193
|
+
exploit_scenario: |-
|
|
2194
|
+
Nil interface panic causes request crash and availability impact.
|
|
2195
|
+
fix_template: |-
|
|
2196
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2197
|
+
pattern-either:
|
|
2198
|
+
- pattern: |-
|
|
2199
|
+
repo.GetUser(ctx, id)
|
|
2200
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-157\\b'
|
|
2201
|
+
message: |-
|
|
2202
|
+
RunSec Detection [GOX-157]: CWE-476
|
|
2203
|
+
languages:
|
|
2204
|
+
- go
|
|
2205
|
+
severity: WARNING
|
|
2206
|
+
- id: runsec.go-core.gox-158
|
|
2207
|
+
metadata:
|
|
2208
|
+
runsec_version: v1.0
|
|
2209
|
+
confidence: |-
|
|
2210
|
+
0.9
|
|
2211
|
+
exploit_scenario: |-
|
|
2212
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2213
|
+
fix_template: |-
|
|
2214
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2215
|
+
pattern-either:
|
|
2216
|
+
- pattern: |-
|
|
2217
|
+
orderID := r.URL.Query().Get("id")
|
|
2218
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-158\\b'
|
|
2219
|
+
message: |-
|
|
2220
|
+
RunSec Detection [GOX-158]: CWE-639
|
|
2221
|
+
languages:
|
|
2222
|
+
- go
|
|
2223
|
+
severity: WARNING
|
|
2224
|
+
- id: runsec.go-core.gox-159
|
|
2225
|
+
metadata:
|
|
2226
|
+
runsec_version: v1.0
|
|
2227
|
+
confidence: |-
|
|
2228
|
+
0.9
|
|
2229
|
+
exploit_scenario: |-
|
|
2230
|
+
Untrusted keys can alter privilege-related fields.
|
|
2231
|
+
fix_template: |-
|
|
2232
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2233
|
+
pattern-either:
|
|
2234
|
+
- pattern: |-
|
|
2235
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2236
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-159\\b'
|
|
2237
|
+
message: |-
|
|
2238
|
+
RunSec Detection [GOX-159]: CWE-915
|
|
2239
|
+
languages:
|
|
2240
|
+
- go
|
|
2241
|
+
severity: WARNING
|
|
2242
|
+
- id: runsec.go-core.gox-160
|
|
2243
|
+
metadata:
|
|
2244
|
+
runsec_version: v1.0
|
|
2245
|
+
confidence: |-
|
|
2246
|
+
0.9
|
|
2247
|
+
exploit_scenario: |-
|
|
2248
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2249
|
+
fix_template: |-
|
|
2250
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2251
|
+
pattern-either:
|
|
2252
|
+
- pattern: |-
|
|
2253
|
+
go worker(task)
|
|
2254
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-160\\b'
|
|
2255
|
+
message: |-
|
|
2256
|
+
RunSec Detection [GOX-160]: CWE-667
|
|
2257
|
+
languages:
|
|
2258
|
+
- go
|
|
2259
|
+
severity: WARNING
|
|
2260
|
+
- id: runsec.go-core.gox-161
|
|
2261
|
+
metadata:
|
|
2262
|
+
runsec_version: v1.0
|
|
2263
|
+
confidence: |-
|
|
2264
|
+
0.9
|
|
2265
|
+
exploit_scenario: |-
|
|
2266
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2267
|
+
fix_template: |-
|
|
2268
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2269
|
+
pattern-either:
|
|
2270
|
+
- pattern: |-
|
|
2271
|
+
go func(){ sharedCounter++ }()
|
|
2272
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-161\\b'
|
|
2273
|
+
message: |-
|
|
2274
|
+
RunSec Detection [GOX-161]: CWE-662
|
|
2275
|
+
languages:
|
|
2276
|
+
- go
|
|
2277
|
+
severity: WARNING
|
|
2278
|
+
- id: runsec.go-core.gox-162
|
|
2279
|
+
metadata:
|
|
2280
|
+
runsec_version: v1.0
|
|
2281
|
+
confidence: |-
|
|
2282
|
+
0.9
|
|
2283
|
+
exploit_scenario: |-
|
|
2284
|
+
Nil interface panic causes request crash and availability impact.
|
|
2285
|
+
fix_template: |-
|
|
2286
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2287
|
+
pattern-either:
|
|
2288
|
+
- pattern: |-
|
|
2289
|
+
repo.GetUser(ctx, id)
|
|
2290
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-162\\b'
|
|
2291
|
+
message: |-
|
|
2292
|
+
RunSec Detection [GOX-162]: CWE-476
|
|
2293
|
+
languages:
|
|
2294
|
+
- go
|
|
2295
|
+
severity: WARNING
|
|
2296
|
+
- id: runsec.go-core.gox-163
|
|
2297
|
+
metadata:
|
|
2298
|
+
runsec_version: v1.0
|
|
2299
|
+
confidence: |-
|
|
2300
|
+
0.9
|
|
2301
|
+
exploit_scenario: |-
|
|
2302
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2303
|
+
fix_template: |-
|
|
2304
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2305
|
+
pattern-either:
|
|
2306
|
+
- pattern: |-
|
|
2307
|
+
orderID := r.URL.Query().Get("id")
|
|
2308
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-163\\b'
|
|
2309
|
+
message: |-
|
|
2310
|
+
RunSec Detection [GOX-163]: CWE-639
|
|
2311
|
+
languages:
|
|
2312
|
+
- go
|
|
2313
|
+
severity: WARNING
|
|
2314
|
+
- id: runsec.go-core.gox-164
|
|
2315
|
+
metadata:
|
|
2316
|
+
runsec_version: v1.0
|
|
2317
|
+
confidence: |-
|
|
2318
|
+
0.9
|
|
2319
|
+
exploit_scenario: |-
|
|
2320
|
+
Untrusted keys can alter privilege-related fields.
|
|
2321
|
+
fix_template: |-
|
|
2322
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2323
|
+
pattern-either:
|
|
2324
|
+
- pattern: |-
|
|
2325
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2326
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-164\\b'
|
|
2327
|
+
message: |-
|
|
2328
|
+
RunSec Detection [GOX-164]: CWE-915
|
|
2329
|
+
languages:
|
|
2330
|
+
- go
|
|
2331
|
+
severity: WARNING
|
|
2332
|
+
- id: runsec.go-core.gox-165
|
|
2333
|
+
metadata:
|
|
2334
|
+
runsec_version: v1.0
|
|
2335
|
+
confidence: |-
|
|
2336
|
+
0.9
|
|
2337
|
+
exploit_scenario: |-
|
|
2338
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2339
|
+
fix_template: |-
|
|
2340
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2341
|
+
pattern-either:
|
|
2342
|
+
- pattern: |-
|
|
2343
|
+
go worker(task)
|
|
2344
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-165\\b'
|
|
2345
|
+
message: |-
|
|
2346
|
+
RunSec Detection [GOX-165]: CWE-667
|
|
2347
|
+
languages:
|
|
2348
|
+
- go
|
|
2349
|
+
severity: WARNING
|
|
2350
|
+
- id: runsec.go-core.gox-166
|
|
2351
|
+
metadata:
|
|
2352
|
+
runsec_version: v1.0
|
|
2353
|
+
confidence: |-
|
|
2354
|
+
0.9
|
|
2355
|
+
exploit_scenario: |-
|
|
2356
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2357
|
+
fix_template: |-
|
|
2358
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2359
|
+
pattern-either:
|
|
2360
|
+
- pattern: |-
|
|
2361
|
+
go func(){ sharedCounter++ }()
|
|
2362
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-166\\b'
|
|
2363
|
+
message: |-
|
|
2364
|
+
RunSec Detection [GOX-166]: CWE-662
|
|
2365
|
+
languages:
|
|
2366
|
+
- go
|
|
2367
|
+
severity: WARNING
|
|
2368
|
+
- id: runsec.go-core.gox-167
|
|
2369
|
+
metadata:
|
|
2370
|
+
runsec_version: v1.0
|
|
2371
|
+
confidence: |-
|
|
2372
|
+
0.9
|
|
2373
|
+
exploit_scenario: |-
|
|
2374
|
+
Nil interface panic causes request crash and availability impact.
|
|
2375
|
+
fix_template: |-
|
|
2376
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2377
|
+
pattern-either:
|
|
2378
|
+
- pattern: |-
|
|
2379
|
+
repo.GetUser(ctx, id)
|
|
2380
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-167\\b'
|
|
2381
|
+
message: |-
|
|
2382
|
+
RunSec Detection [GOX-167]: CWE-476
|
|
2383
|
+
languages:
|
|
2384
|
+
- go
|
|
2385
|
+
severity: WARNING
|
|
2386
|
+
- id: runsec.go-core.gox-168
|
|
2387
|
+
metadata:
|
|
2388
|
+
runsec_version: v1.0
|
|
2389
|
+
confidence: |-
|
|
2390
|
+
0.9
|
|
2391
|
+
exploit_scenario: |-
|
|
2392
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2393
|
+
fix_template: |-
|
|
2394
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2395
|
+
pattern-either:
|
|
2396
|
+
- pattern: |-
|
|
2397
|
+
orderID := r.URL.Query().Get("id")
|
|
2398
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-168\\b'
|
|
2399
|
+
message: |-
|
|
2400
|
+
RunSec Detection [GOX-168]: CWE-639
|
|
2401
|
+
languages:
|
|
2402
|
+
- go
|
|
2403
|
+
severity: WARNING
|
|
2404
|
+
- id: runsec.go-core.gox-169
|
|
2405
|
+
metadata:
|
|
2406
|
+
runsec_version: v1.0
|
|
2407
|
+
confidence: |-
|
|
2408
|
+
0.9
|
|
2409
|
+
exploit_scenario: |-
|
|
2410
|
+
Untrusted keys can alter privilege-related fields.
|
|
2411
|
+
fix_template: |-
|
|
2412
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2413
|
+
pattern-either:
|
|
2414
|
+
- pattern: |-
|
|
2415
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2416
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-169\\b'
|
|
2417
|
+
message: |-
|
|
2418
|
+
RunSec Detection [GOX-169]: CWE-915
|
|
2419
|
+
languages:
|
|
2420
|
+
- go
|
|
2421
|
+
severity: WARNING
|
|
2422
|
+
- id: runsec.go-core.gox-170
|
|
2423
|
+
metadata:
|
|
2424
|
+
runsec_version: v1.0
|
|
2425
|
+
confidence: |-
|
|
2426
|
+
0.9
|
|
2427
|
+
exploit_scenario: |-
|
|
2428
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2429
|
+
fix_template: |-
|
|
2430
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2431
|
+
pattern-either:
|
|
2432
|
+
- pattern: |-
|
|
2433
|
+
go worker(task)
|
|
2434
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-170\\b'
|
|
2435
|
+
message: |-
|
|
2436
|
+
RunSec Detection [GOX-170]: CWE-667
|
|
2437
|
+
languages:
|
|
2438
|
+
- go
|
|
2439
|
+
severity: WARNING
|
|
2440
|
+
- id: runsec.go-core.gox-171
|
|
2441
|
+
metadata:
|
|
2442
|
+
runsec_version: v1.0
|
|
2443
|
+
confidence: |-
|
|
2444
|
+
0.9
|
|
2445
|
+
exploit_scenario: |-
|
|
2446
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2447
|
+
fix_template: |-
|
|
2448
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2449
|
+
pattern-either:
|
|
2450
|
+
- pattern: |-
|
|
2451
|
+
go func(){ sharedCounter++ }()
|
|
2452
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-171\\b'
|
|
2453
|
+
message: |-
|
|
2454
|
+
RunSec Detection [GOX-171]: CWE-662
|
|
2455
|
+
languages:
|
|
2456
|
+
- go
|
|
2457
|
+
severity: WARNING
|
|
2458
|
+
- id: runsec.go-core.gox-172
|
|
2459
|
+
metadata:
|
|
2460
|
+
runsec_version: v1.0
|
|
2461
|
+
confidence: |-
|
|
2462
|
+
0.9
|
|
2463
|
+
exploit_scenario: |-
|
|
2464
|
+
Nil interface panic causes request crash and availability impact.
|
|
2465
|
+
fix_template: |-
|
|
2466
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2467
|
+
pattern-either:
|
|
2468
|
+
- pattern: |-
|
|
2469
|
+
repo.GetUser(ctx, id)
|
|
2470
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-172\\b'
|
|
2471
|
+
message: |-
|
|
2472
|
+
RunSec Detection [GOX-172]: CWE-476
|
|
2473
|
+
languages:
|
|
2474
|
+
- go
|
|
2475
|
+
severity: WARNING
|
|
2476
|
+
- id: runsec.go-core.gox-173
|
|
2477
|
+
metadata:
|
|
2478
|
+
runsec_version: v1.0
|
|
2479
|
+
confidence: |-
|
|
2480
|
+
0.9
|
|
2481
|
+
exploit_scenario: |-
|
|
2482
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2483
|
+
fix_template: |-
|
|
2484
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2485
|
+
pattern-either:
|
|
2486
|
+
- pattern: |-
|
|
2487
|
+
orderID := r.URL.Query().Get("id")
|
|
2488
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-173\\b'
|
|
2489
|
+
message: |-
|
|
2490
|
+
RunSec Detection [GOX-173]: CWE-639
|
|
2491
|
+
languages:
|
|
2492
|
+
- go
|
|
2493
|
+
severity: WARNING
|
|
2494
|
+
- id: runsec.go-core.gox-174
|
|
2495
|
+
metadata:
|
|
2496
|
+
runsec_version: v1.0
|
|
2497
|
+
confidence: |-
|
|
2498
|
+
0.9
|
|
2499
|
+
exploit_scenario: |-
|
|
2500
|
+
Untrusted keys can alter privilege-related fields.
|
|
2501
|
+
fix_template: |-
|
|
2502
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2503
|
+
pattern-either:
|
|
2504
|
+
- pattern: |-
|
|
2505
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2506
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-174\\b'
|
|
2507
|
+
message: |-
|
|
2508
|
+
RunSec Detection [GOX-174]: CWE-915
|
|
2509
|
+
languages:
|
|
2510
|
+
- go
|
|
2511
|
+
severity: WARNING
|
|
2512
|
+
- id: runsec.go-core.gox-175
|
|
2513
|
+
metadata:
|
|
2514
|
+
runsec_version: v1.0
|
|
2515
|
+
confidence: |-
|
|
2516
|
+
0.9
|
|
2517
|
+
exploit_scenario: |-
|
|
2518
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2519
|
+
fix_template: |-
|
|
2520
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2521
|
+
pattern-either:
|
|
2522
|
+
- pattern: |-
|
|
2523
|
+
go worker(task)
|
|
2524
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-175\\b'
|
|
2525
|
+
message: |-
|
|
2526
|
+
RunSec Detection [GOX-175]: CWE-667
|
|
2527
|
+
languages:
|
|
2528
|
+
- go
|
|
2529
|
+
severity: WARNING
|
|
2530
|
+
- id: runsec.go-core.gox-176
|
|
2531
|
+
metadata:
|
|
2532
|
+
runsec_version: v1.0
|
|
2533
|
+
confidence: |-
|
|
2534
|
+
0.9
|
|
2535
|
+
exploit_scenario: |-
|
|
2536
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2537
|
+
fix_template: |-
|
|
2538
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2539
|
+
pattern-either:
|
|
2540
|
+
- pattern: |-
|
|
2541
|
+
go func(){ sharedCounter++ }()
|
|
2542
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-176\\b'
|
|
2543
|
+
message: |-
|
|
2544
|
+
RunSec Detection [GOX-176]: CWE-662
|
|
2545
|
+
languages:
|
|
2546
|
+
- go
|
|
2547
|
+
severity: WARNING
|
|
2548
|
+
- id: runsec.go-core.gox-177
|
|
2549
|
+
metadata:
|
|
2550
|
+
runsec_version: v1.0
|
|
2551
|
+
confidence: |-
|
|
2552
|
+
0.9
|
|
2553
|
+
exploit_scenario: |-
|
|
2554
|
+
Nil interface panic causes request crash and availability impact.
|
|
2555
|
+
fix_template: |-
|
|
2556
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2557
|
+
pattern-either:
|
|
2558
|
+
- pattern: |-
|
|
2559
|
+
repo.GetUser(ctx, id)
|
|
2560
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-177\\b'
|
|
2561
|
+
message: |-
|
|
2562
|
+
RunSec Detection [GOX-177]: CWE-476
|
|
2563
|
+
languages:
|
|
2564
|
+
- go
|
|
2565
|
+
severity: WARNING
|
|
2566
|
+
- id: runsec.go-core.gox-178
|
|
2567
|
+
metadata:
|
|
2568
|
+
runsec_version: v1.0
|
|
2569
|
+
confidence: |-
|
|
2570
|
+
0.9
|
|
2571
|
+
exploit_scenario: |-
|
|
2572
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2573
|
+
fix_template: |-
|
|
2574
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2575
|
+
pattern-either:
|
|
2576
|
+
- pattern: |-
|
|
2577
|
+
orderID := r.URL.Query().Get("id")
|
|
2578
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-178\\b'
|
|
2579
|
+
message: |-
|
|
2580
|
+
RunSec Detection [GOX-178]: CWE-639
|
|
2581
|
+
languages:
|
|
2582
|
+
- go
|
|
2583
|
+
severity: WARNING
|
|
2584
|
+
- id: runsec.go-core.gox-179
|
|
2585
|
+
metadata:
|
|
2586
|
+
runsec_version: v1.0
|
|
2587
|
+
confidence: |-
|
|
2588
|
+
0.9
|
|
2589
|
+
exploit_scenario: |-
|
|
2590
|
+
Untrusted keys can alter privilege-related fields.
|
|
2591
|
+
fix_template: |-
|
|
2592
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2593
|
+
pattern-either:
|
|
2594
|
+
- pattern: |-
|
|
2595
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2596
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-179\\b'
|
|
2597
|
+
message: |-
|
|
2598
|
+
RunSec Detection [GOX-179]: CWE-915
|
|
2599
|
+
languages:
|
|
2600
|
+
- go
|
|
2601
|
+
severity: WARNING
|
|
2602
|
+
- id: runsec.go-core.gox-180
|
|
2603
|
+
metadata:
|
|
2604
|
+
runsec_version: v1.0
|
|
2605
|
+
confidence: |-
|
|
2606
|
+
0.9
|
|
2607
|
+
exploit_scenario: |-
|
|
2608
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2609
|
+
fix_template: |-
|
|
2610
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2611
|
+
pattern-either:
|
|
2612
|
+
- pattern: |-
|
|
2613
|
+
go worker(task)
|
|
2614
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-180\\b'
|
|
2615
|
+
message: |-
|
|
2616
|
+
RunSec Detection [GOX-180]: CWE-667
|
|
2617
|
+
languages:
|
|
2618
|
+
- go
|
|
2619
|
+
severity: WARNING
|
|
2620
|
+
- id: runsec.go-core.gox-181
|
|
2621
|
+
metadata:
|
|
2622
|
+
runsec_version: v1.0
|
|
2623
|
+
confidence: |-
|
|
2624
|
+
0.9
|
|
2625
|
+
exploit_scenario: |-
|
|
2626
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2627
|
+
fix_template: |-
|
|
2628
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2629
|
+
pattern-either:
|
|
2630
|
+
- pattern: |-
|
|
2631
|
+
go func(){ sharedCounter++ }()
|
|
2632
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-181\\b'
|
|
2633
|
+
message: |-
|
|
2634
|
+
RunSec Detection [GOX-181]: CWE-662
|
|
2635
|
+
languages:
|
|
2636
|
+
- go
|
|
2637
|
+
severity: WARNING
|
|
2638
|
+
- id: runsec.go-core.gox-182
|
|
2639
|
+
metadata:
|
|
2640
|
+
runsec_version: v1.0
|
|
2641
|
+
confidence: |-
|
|
2642
|
+
0.9
|
|
2643
|
+
exploit_scenario: |-
|
|
2644
|
+
Nil interface panic causes request crash and availability impact.
|
|
2645
|
+
fix_template: |-
|
|
2646
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2647
|
+
pattern-either:
|
|
2648
|
+
- pattern: |-
|
|
2649
|
+
repo.GetUser(ctx, id)
|
|
2650
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-182\\b'
|
|
2651
|
+
message: |-
|
|
2652
|
+
RunSec Detection [GOX-182]: CWE-476
|
|
2653
|
+
languages:
|
|
2654
|
+
- go
|
|
2655
|
+
severity: WARNING
|
|
2656
|
+
- id: runsec.go-core.gox-183
|
|
2657
|
+
metadata:
|
|
2658
|
+
runsec_version: v1.0
|
|
2659
|
+
confidence: |-
|
|
2660
|
+
0.9
|
|
2661
|
+
exploit_scenario: |-
|
|
2662
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2663
|
+
fix_template: |-
|
|
2664
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2665
|
+
pattern-either:
|
|
2666
|
+
- pattern: |-
|
|
2667
|
+
orderID := r.URL.Query().Get("id")
|
|
2668
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-183\\b'
|
|
2669
|
+
message: |-
|
|
2670
|
+
RunSec Detection [GOX-183]: CWE-639
|
|
2671
|
+
languages:
|
|
2672
|
+
- go
|
|
2673
|
+
severity: WARNING
|
|
2674
|
+
- id: runsec.go-core.gox-184
|
|
2675
|
+
metadata:
|
|
2676
|
+
runsec_version: v1.0
|
|
2677
|
+
confidence: |-
|
|
2678
|
+
0.9
|
|
2679
|
+
exploit_scenario: |-
|
|
2680
|
+
Untrusted keys can alter privilege-related fields.
|
|
2681
|
+
fix_template: |-
|
|
2682
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2683
|
+
pattern-either:
|
|
2684
|
+
- pattern: |-
|
|
2685
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2686
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-184\\b'
|
|
2687
|
+
message: |-
|
|
2688
|
+
RunSec Detection [GOX-184]: CWE-915
|
|
2689
|
+
languages:
|
|
2690
|
+
- go
|
|
2691
|
+
severity: WARNING
|
|
2692
|
+
- id: runsec.go-core.gox-185
|
|
2693
|
+
metadata:
|
|
2694
|
+
runsec_version: v1.0
|
|
2695
|
+
confidence: |-
|
|
2696
|
+
0.9
|
|
2697
|
+
exploit_scenario: |-
|
|
2698
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2699
|
+
fix_template: |-
|
|
2700
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2701
|
+
pattern-either:
|
|
2702
|
+
- pattern: |-
|
|
2703
|
+
go worker(task)
|
|
2704
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-185\\b'
|
|
2705
|
+
message: |-
|
|
2706
|
+
RunSec Detection [GOX-185]: CWE-667
|
|
2707
|
+
languages:
|
|
2708
|
+
- go
|
|
2709
|
+
severity: WARNING
|
|
2710
|
+
- id: runsec.go-core.gox-186
|
|
2711
|
+
metadata:
|
|
2712
|
+
runsec_version: v1.0
|
|
2713
|
+
confidence: |-
|
|
2714
|
+
0.9
|
|
2715
|
+
exploit_scenario: |-
|
|
2716
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2717
|
+
fix_template: |-
|
|
2718
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2719
|
+
pattern-either:
|
|
2720
|
+
- pattern: |-
|
|
2721
|
+
go func(){ sharedCounter++ }()
|
|
2722
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-186\\b'
|
|
2723
|
+
message: |-
|
|
2724
|
+
RunSec Detection [GOX-186]: CWE-662
|
|
2725
|
+
languages:
|
|
2726
|
+
- go
|
|
2727
|
+
severity: WARNING
|
|
2728
|
+
- id: runsec.go-core.gox-187
|
|
2729
|
+
metadata:
|
|
2730
|
+
runsec_version: v1.0
|
|
2731
|
+
confidence: |-
|
|
2732
|
+
0.9
|
|
2733
|
+
exploit_scenario: |-
|
|
2734
|
+
Nil interface panic causes request crash and availability impact.
|
|
2735
|
+
fix_template: |-
|
|
2736
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2737
|
+
pattern-either:
|
|
2738
|
+
- pattern: |-
|
|
2739
|
+
repo.GetUser(ctx, id)
|
|
2740
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-187\\b'
|
|
2741
|
+
message: |-
|
|
2742
|
+
RunSec Detection [GOX-187]: CWE-476
|
|
2743
|
+
languages:
|
|
2744
|
+
- go
|
|
2745
|
+
severity: WARNING
|
|
2746
|
+
- id: runsec.go-core.gox-188
|
|
2747
|
+
metadata:
|
|
2748
|
+
runsec_version: v1.0
|
|
2749
|
+
confidence: |-
|
|
2750
|
+
0.9
|
|
2751
|
+
exploit_scenario: |-
|
|
2752
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2753
|
+
fix_template: |-
|
|
2754
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2755
|
+
pattern-either:
|
|
2756
|
+
- pattern: |-
|
|
2757
|
+
orderID := r.URL.Query().Get("id")
|
|
2758
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-188\\b'
|
|
2759
|
+
message: |-
|
|
2760
|
+
RunSec Detection [GOX-188]: CWE-639
|
|
2761
|
+
languages:
|
|
2762
|
+
- go
|
|
2763
|
+
severity: WARNING
|
|
2764
|
+
- id: runsec.go-core.gox-189
|
|
2765
|
+
metadata:
|
|
2766
|
+
runsec_version: v1.0
|
|
2767
|
+
confidence: |-
|
|
2768
|
+
0.9
|
|
2769
|
+
exploit_scenario: |-
|
|
2770
|
+
Untrusted keys can alter privilege-related fields.
|
|
2771
|
+
fix_template: |-
|
|
2772
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2773
|
+
pattern-either:
|
|
2774
|
+
- pattern: |-
|
|
2775
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2776
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-189\\b'
|
|
2777
|
+
message: |-
|
|
2778
|
+
RunSec Detection [GOX-189]: CWE-915
|
|
2779
|
+
languages:
|
|
2780
|
+
- go
|
|
2781
|
+
severity: WARNING
|
|
2782
|
+
- id: runsec.go-core.gox-190
|
|
2783
|
+
metadata:
|
|
2784
|
+
runsec_version: v1.0
|
|
2785
|
+
confidence: |-
|
|
2786
|
+
0.9
|
|
2787
|
+
exploit_scenario: |-
|
|
2788
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2789
|
+
fix_template: |-
|
|
2790
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2791
|
+
pattern-either:
|
|
2792
|
+
- pattern: |-
|
|
2793
|
+
go worker(task)
|
|
2794
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-190\\b'
|
|
2795
|
+
message: |-
|
|
2796
|
+
RunSec Detection [GOX-190]: CWE-667
|
|
2797
|
+
languages:
|
|
2798
|
+
- go
|
|
2799
|
+
severity: WARNING
|
|
2800
|
+
- id: runsec.go-core.gox-191
|
|
2801
|
+
metadata:
|
|
2802
|
+
runsec_version: v1.0
|
|
2803
|
+
confidence: |-
|
|
2804
|
+
0.9
|
|
2805
|
+
exploit_scenario: |-
|
|
2806
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2807
|
+
fix_template: |-
|
|
2808
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2809
|
+
pattern-either:
|
|
2810
|
+
- pattern: |-
|
|
2811
|
+
go func(){ sharedCounter++ }()
|
|
2812
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-191\\b'
|
|
2813
|
+
message: |-
|
|
2814
|
+
RunSec Detection [GOX-191]: CWE-662
|
|
2815
|
+
languages:
|
|
2816
|
+
- go
|
|
2817
|
+
severity: WARNING
|
|
2818
|
+
- id: runsec.go-core.gox-192
|
|
2819
|
+
metadata:
|
|
2820
|
+
runsec_version: v1.0
|
|
2821
|
+
confidence: |-
|
|
2822
|
+
0.9
|
|
2823
|
+
exploit_scenario: |-
|
|
2824
|
+
Nil interface panic causes request crash and availability impact.
|
|
2825
|
+
fix_template: |-
|
|
2826
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2827
|
+
pattern-either:
|
|
2828
|
+
- pattern: |-
|
|
2829
|
+
repo.GetUser(ctx, id)
|
|
2830
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-192\\b'
|
|
2831
|
+
message: |-
|
|
2832
|
+
RunSec Detection [GOX-192]: CWE-476
|
|
2833
|
+
languages:
|
|
2834
|
+
- go
|
|
2835
|
+
severity: WARNING
|
|
2836
|
+
- id: runsec.go-core.gox-193
|
|
2837
|
+
metadata:
|
|
2838
|
+
runsec_version: v1.0
|
|
2839
|
+
confidence: |-
|
|
2840
|
+
0.9
|
|
2841
|
+
exploit_scenario: |-
|
|
2842
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2843
|
+
fix_template: |-
|
|
2844
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2845
|
+
pattern-either:
|
|
2846
|
+
- pattern: |-
|
|
2847
|
+
orderID := r.URL.Query().Get("id")
|
|
2848
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-193\\b'
|
|
2849
|
+
message: |-
|
|
2850
|
+
RunSec Detection [GOX-193]: CWE-639
|
|
2851
|
+
languages:
|
|
2852
|
+
- go
|
|
2853
|
+
severity: WARNING
|
|
2854
|
+
- id: runsec.go-core.gox-194
|
|
2855
|
+
metadata:
|
|
2856
|
+
runsec_version: v1.0
|
|
2857
|
+
confidence: |-
|
|
2858
|
+
0.9
|
|
2859
|
+
exploit_scenario: |-
|
|
2860
|
+
Untrusted keys can alter privilege-related fields.
|
|
2861
|
+
fix_template: |-
|
|
2862
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2863
|
+
pattern-either:
|
|
2864
|
+
- pattern: |-
|
|
2865
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2866
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-194\\b'
|
|
2867
|
+
message: |-
|
|
2868
|
+
RunSec Detection [GOX-194]: CWE-915
|
|
2869
|
+
languages:
|
|
2870
|
+
- go
|
|
2871
|
+
severity: WARNING
|
|
2872
|
+
- id: runsec.go-core.gox-195
|
|
2873
|
+
metadata:
|
|
2874
|
+
runsec_version: v1.0
|
|
2875
|
+
confidence: |-
|
|
2876
|
+
0.9
|
|
2877
|
+
exploit_scenario: |-
|
|
2878
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2879
|
+
fix_template: |-
|
|
2880
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2881
|
+
pattern-either:
|
|
2882
|
+
- pattern: |-
|
|
2883
|
+
go worker(task)
|
|
2884
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-195\\b'
|
|
2885
|
+
message: |-
|
|
2886
|
+
RunSec Detection [GOX-195]: CWE-667
|
|
2887
|
+
languages:
|
|
2888
|
+
- go
|
|
2889
|
+
severity: WARNING
|
|
2890
|
+
- id: runsec.go-core.gox-196
|
|
2891
|
+
metadata:
|
|
2892
|
+
runsec_version: v1.0
|
|
2893
|
+
confidence: |-
|
|
2894
|
+
0.9
|
|
2895
|
+
exploit_scenario: |-
|
|
2896
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2897
|
+
fix_template: |-
|
|
2898
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2899
|
+
pattern-either:
|
|
2900
|
+
- pattern: |-
|
|
2901
|
+
go func(){ sharedCounter++ }()
|
|
2902
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-196\\b'
|
|
2903
|
+
message: |-
|
|
2904
|
+
RunSec Detection [GOX-196]: CWE-662
|
|
2905
|
+
languages:
|
|
2906
|
+
- go
|
|
2907
|
+
severity: WARNING
|
|
2908
|
+
- id: runsec.go-core.gox-197
|
|
2909
|
+
metadata:
|
|
2910
|
+
runsec_version: v1.0
|
|
2911
|
+
confidence: |-
|
|
2912
|
+
0.9
|
|
2913
|
+
exploit_scenario: |-
|
|
2914
|
+
Nil interface panic causes request crash and availability impact.
|
|
2915
|
+
fix_template: |-
|
|
2916
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
2917
|
+
pattern-either:
|
|
2918
|
+
- pattern: |-
|
|
2919
|
+
repo.GetUser(ctx, id)
|
|
2920
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-197\\b'
|
|
2921
|
+
message: |-
|
|
2922
|
+
RunSec Detection [GOX-197]: CWE-476
|
|
2923
|
+
languages:
|
|
2924
|
+
- go
|
|
2925
|
+
severity: WARNING
|
|
2926
|
+
- id: runsec.go-core.gox-198
|
|
2927
|
+
metadata:
|
|
2928
|
+
runsec_version: v1.0
|
|
2929
|
+
confidence: |-
|
|
2930
|
+
0.9
|
|
2931
|
+
exploit_scenario: |-
|
|
2932
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
2933
|
+
fix_template: |-
|
|
2934
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
2935
|
+
pattern-either:
|
|
2936
|
+
- pattern: |-
|
|
2937
|
+
orderID := r.URL.Query().Get("id")
|
|
2938
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-198\\b'
|
|
2939
|
+
message: |-
|
|
2940
|
+
RunSec Detection [GOX-198]: CWE-639
|
|
2941
|
+
languages:
|
|
2942
|
+
- go
|
|
2943
|
+
severity: WARNING
|
|
2944
|
+
- id: runsec.go-core.gox-199
|
|
2945
|
+
metadata:
|
|
2946
|
+
runsec_version: v1.0
|
|
2947
|
+
confidence: |-
|
|
2948
|
+
0.9
|
|
2949
|
+
exploit_scenario: |-
|
|
2950
|
+
Untrusted keys can alter privilege-related fields.
|
|
2951
|
+
fix_template: |-
|
|
2952
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
2953
|
+
pattern-either:
|
|
2954
|
+
- pattern: |-
|
|
2955
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
2956
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-199\\b'
|
|
2957
|
+
message: |-
|
|
2958
|
+
RunSec Detection [GOX-199]: CWE-915
|
|
2959
|
+
languages:
|
|
2960
|
+
- go
|
|
2961
|
+
severity: WARNING
|
|
2962
|
+
- id: runsec.go-core.gox-200
|
|
2963
|
+
metadata:
|
|
2964
|
+
runsec_version: v1.0
|
|
2965
|
+
confidence: |-
|
|
2966
|
+
0.9
|
|
2967
|
+
exploit_scenario: |-
|
|
2968
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
2969
|
+
fix_template: |-
|
|
2970
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
2971
|
+
pattern-either:
|
|
2972
|
+
- pattern: |-
|
|
2973
|
+
go worker(task)
|
|
2974
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-200\\b'
|
|
2975
|
+
message: |-
|
|
2976
|
+
RunSec Detection [GOX-200]: CWE-667
|
|
2977
|
+
languages:
|
|
2978
|
+
- go
|
|
2979
|
+
severity: WARNING
|
|
2980
|
+
- id: runsec.go-core.gox-201
|
|
2981
|
+
metadata:
|
|
2982
|
+
runsec_version: v1.0
|
|
2983
|
+
confidence: |-
|
|
2984
|
+
0.9
|
|
2985
|
+
exploit_scenario: |-
|
|
2986
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
2987
|
+
fix_template: |-
|
|
2988
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
2989
|
+
pattern-either:
|
|
2990
|
+
- pattern: |-
|
|
2991
|
+
go func(){ sharedCounter++ }()
|
|
2992
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-201\\b'
|
|
2993
|
+
message: |-
|
|
2994
|
+
RunSec Detection [GOX-201]: CWE-662
|
|
2995
|
+
languages:
|
|
2996
|
+
- go
|
|
2997
|
+
severity: WARNING
|
|
2998
|
+
- id: runsec.go-core.gox-202
|
|
2999
|
+
metadata:
|
|
3000
|
+
runsec_version: v1.0
|
|
3001
|
+
confidence: |-
|
|
3002
|
+
0.9
|
|
3003
|
+
exploit_scenario: |-
|
|
3004
|
+
Nil interface panic causes request crash and availability impact.
|
|
3005
|
+
fix_template: |-
|
|
3006
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3007
|
+
pattern-either:
|
|
3008
|
+
- pattern: |-
|
|
3009
|
+
repo.GetUser(ctx, id)
|
|
3010
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-202\\b'
|
|
3011
|
+
message: |-
|
|
3012
|
+
RunSec Detection [GOX-202]: CWE-476
|
|
3013
|
+
languages:
|
|
3014
|
+
- go
|
|
3015
|
+
severity: WARNING
|
|
3016
|
+
- id: runsec.go-core.gox-203
|
|
3017
|
+
metadata:
|
|
3018
|
+
runsec_version: v1.0
|
|
3019
|
+
confidence: |-
|
|
3020
|
+
0.9
|
|
3021
|
+
exploit_scenario: |-
|
|
3022
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3023
|
+
fix_template: |-
|
|
3024
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3025
|
+
pattern-either:
|
|
3026
|
+
- pattern: |-
|
|
3027
|
+
orderID := r.URL.Query().Get("id")
|
|
3028
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-203\\b'
|
|
3029
|
+
message: |-
|
|
3030
|
+
RunSec Detection [GOX-203]: CWE-639
|
|
3031
|
+
languages:
|
|
3032
|
+
- go
|
|
3033
|
+
severity: WARNING
|
|
3034
|
+
- id: runsec.go-core.gox-204
|
|
3035
|
+
metadata:
|
|
3036
|
+
runsec_version: v1.0
|
|
3037
|
+
confidence: |-
|
|
3038
|
+
0.9
|
|
3039
|
+
exploit_scenario: |-
|
|
3040
|
+
Untrusted keys can alter privilege-related fields.
|
|
3041
|
+
fix_template: |-
|
|
3042
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3043
|
+
pattern-either:
|
|
3044
|
+
- pattern: |-
|
|
3045
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3046
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-204\\b'
|
|
3047
|
+
message: |-
|
|
3048
|
+
RunSec Detection [GOX-204]: CWE-915
|
|
3049
|
+
languages:
|
|
3050
|
+
- go
|
|
3051
|
+
severity: WARNING
|
|
3052
|
+
- id: runsec.go-core.gox-205
|
|
3053
|
+
metadata:
|
|
3054
|
+
runsec_version: v1.0
|
|
3055
|
+
confidence: |-
|
|
3056
|
+
0.9
|
|
3057
|
+
exploit_scenario: |-
|
|
3058
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3059
|
+
fix_template: |-
|
|
3060
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3061
|
+
pattern-either:
|
|
3062
|
+
- pattern: |-
|
|
3063
|
+
go worker(task)
|
|
3064
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-205\\b'
|
|
3065
|
+
message: |-
|
|
3066
|
+
RunSec Detection [GOX-205]: CWE-667
|
|
3067
|
+
languages:
|
|
3068
|
+
- go
|
|
3069
|
+
severity: WARNING
|
|
3070
|
+
- id: runsec.go-core.gox-206
|
|
3071
|
+
metadata:
|
|
3072
|
+
runsec_version: v1.0
|
|
3073
|
+
confidence: |-
|
|
3074
|
+
0.9
|
|
3075
|
+
exploit_scenario: |-
|
|
3076
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3077
|
+
fix_template: |-
|
|
3078
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3079
|
+
pattern-either:
|
|
3080
|
+
- pattern: |-
|
|
3081
|
+
go func(){ sharedCounter++ }()
|
|
3082
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-206\\b'
|
|
3083
|
+
message: |-
|
|
3084
|
+
RunSec Detection [GOX-206]: CWE-662
|
|
3085
|
+
languages:
|
|
3086
|
+
- go
|
|
3087
|
+
severity: WARNING
|
|
3088
|
+
- id: runsec.go-core.gox-207
|
|
3089
|
+
metadata:
|
|
3090
|
+
runsec_version: v1.0
|
|
3091
|
+
confidence: |-
|
|
3092
|
+
0.9
|
|
3093
|
+
exploit_scenario: |-
|
|
3094
|
+
Nil interface panic causes request crash and availability impact.
|
|
3095
|
+
fix_template: |-
|
|
3096
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3097
|
+
pattern-either:
|
|
3098
|
+
- pattern: |-
|
|
3099
|
+
repo.GetUser(ctx, id)
|
|
3100
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-207\\b'
|
|
3101
|
+
message: |-
|
|
3102
|
+
RunSec Detection [GOX-207]: CWE-476
|
|
3103
|
+
languages:
|
|
3104
|
+
- go
|
|
3105
|
+
severity: WARNING
|
|
3106
|
+
- id: runsec.go-core.gox-208
|
|
3107
|
+
metadata:
|
|
3108
|
+
runsec_version: v1.0
|
|
3109
|
+
confidence: |-
|
|
3110
|
+
0.9
|
|
3111
|
+
exploit_scenario: |-
|
|
3112
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3113
|
+
fix_template: |-
|
|
3114
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3115
|
+
pattern-either:
|
|
3116
|
+
- pattern: |-
|
|
3117
|
+
orderID := r.URL.Query().Get("id")
|
|
3118
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-208\\b'
|
|
3119
|
+
message: |-
|
|
3120
|
+
RunSec Detection [GOX-208]: CWE-639
|
|
3121
|
+
languages:
|
|
3122
|
+
- go
|
|
3123
|
+
severity: WARNING
|
|
3124
|
+
- id: runsec.go-core.gox-209
|
|
3125
|
+
metadata:
|
|
3126
|
+
runsec_version: v1.0
|
|
3127
|
+
confidence: |-
|
|
3128
|
+
0.9
|
|
3129
|
+
exploit_scenario: |-
|
|
3130
|
+
Untrusted keys can alter privilege-related fields.
|
|
3131
|
+
fix_template: |-
|
|
3132
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3133
|
+
pattern-either:
|
|
3134
|
+
- pattern: |-
|
|
3135
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3136
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-209\\b'
|
|
3137
|
+
message: |-
|
|
3138
|
+
RunSec Detection [GOX-209]: CWE-915
|
|
3139
|
+
languages:
|
|
3140
|
+
- go
|
|
3141
|
+
severity: WARNING
|
|
3142
|
+
- id: runsec.go-core.gox-210
|
|
3143
|
+
metadata:
|
|
3144
|
+
runsec_version: v1.0
|
|
3145
|
+
confidence: |-
|
|
3146
|
+
0.9
|
|
3147
|
+
exploit_scenario: |-
|
|
3148
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3149
|
+
fix_template: |-
|
|
3150
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3151
|
+
pattern-either:
|
|
3152
|
+
- pattern: |-
|
|
3153
|
+
go worker(task)
|
|
3154
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-210\\b'
|
|
3155
|
+
message: |-
|
|
3156
|
+
RunSec Detection [GOX-210]: CWE-667
|
|
3157
|
+
languages:
|
|
3158
|
+
- go
|
|
3159
|
+
severity: WARNING
|
|
3160
|
+
- id: runsec.go-core.gox-211
|
|
3161
|
+
metadata:
|
|
3162
|
+
runsec_version: v1.0
|
|
3163
|
+
confidence: |-
|
|
3164
|
+
0.9
|
|
3165
|
+
exploit_scenario: |-
|
|
3166
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3167
|
+
fix_template: |-
|
|
3168
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3169
|
+
pattern-either:
|
|
3170
|
+
- pattern: |-
|
|
3171
|
+
go func(){ sharedCounter++ }()
|
|
3172
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-211\\b'
|
|
3173
|
+
message: |-
|
|
3174
|
+
RunSec Detection [GOX-211]: CWE-662
|
|
3175
|
+
languages:
|
|
3176
|
+
- go
|
|
3177
|
+
severity: WARNING
|
|
3178
|
+
- id: runsec.go-core.gox-212
|
|
3179
|
+
metadata:
|
|
3180
|
+
runsec_version: v1.0
|
|
3181
|
+
confidence: |-
|
|
3182
|
+
0.9
|
|
3183
|
+
exploit_scenario: |-
|
|
3184
|
+
Nil interface panic causes request crash and availability impact.
|
|
3185
|
+
fix_template: |-
|
|
3186
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3187
|
+
pattern-either:
|
|
3188
|
+
- pattern: |-
|
|
3189
|
+
repo.GetUser(ctx, id)
|
|
3190
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-212\\b'
|
|
3191
|
+
message: |-
|
|
3192
|
+
RunSec Detection [GOX-212]: CWE-476
|
|
3193
|
+
languages:
|
|
3194
|
+
- go
|
|
3195
|
+
severity: WARNING
|
|
3196
|
+
- id: runsec.go-core.gox-213
|
|
3197
|
+
metadata:
|
|
3198
|
+
runsec_version: v1.0
|
|
3199
|
+
confidence: |-
|
|
3200
|
+
0.9
|
|
3201
|
+
exploit_scenario: |-
|
|
3202
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3203
|
+
fix_template: |-
|
|
3204
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3205
|
+
pattern-either:
|
|
3206
|
+
- pattern: |-
|
|
3207
|
+
orderID := r.URL.Query().Get("id")
|
|
3208
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-213\\b'
|
|
3209
|
+
message: |-
|
|
3210
|
+
RunSec Detection [GOX-213]: CWE-639
|
|
3211
|
+
languages:
|
|
3212
|
+
- go
|
|
3213
|
+
severity: WARNING
|
|
3214
|
+
- id: runsec.go-core.gox-214
|
|
3215
|
+
metadata:
|
|
3216
|
+
runsec_version: v1.0
|
|
3217
|
+
confidence: |-
|
|
3218
|
+
0.9
|
|
3219
|
+
exploit_scenario: |-
|
|
3220
|
+
Untrusted keys can alter privilege-related fields.
|
|
3221
|
+
fix_template: |-
|
|
3222
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3223
|
+
pattern-either:
|
|
3224
|
+
- pattern: |-
|
|
3225
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3226
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-214\\b'
|
|
3227
|
+
message: |-
|
|
3228
|
+
RunSec Detection [GOX-214]: CWE-915
|
|
3229
|
+
languages:
|
|
3230
|
+
- go
|
|
3231
|
+
severity: WARNING
|
|
3232
|
+
- id: runsec.go-core.gox-215
|
|
3233
|
+
metadata:
|
|
3234
|
+
runsec_version: v1.0
|
|
3235
|
+
confidence: |-
|
|
3236
|
+
0.9
|
|
3237
|
+
exploit_scenario: |-
|
|
3238
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3239
|
+
fix_template: |-
|
|
3240
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3241
|
+
pattern-either:
|
|
3242
|
+
- pattern: |-
|
|
3243
|
+
go worker(task)
|
|
3244
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-215\\b'
|
|
3245
|
+
message: |-
|
|
3246
|
+
RunSec Detection [GOX-215]: CWE-667
|
|
3247
|
+
languages:
|
|
3248
|
+
- go
|
|
3249
|
+
severity: WARNING
|
|
3250
|
+
- id: runsec.go-core.gox-216
|
|
3251
|
+
metadata:
|
|
3252
|
+
runsec_version: v1.0
|
|
3253
|
+
confidence: |-
|
|
3254
|
+
0.9
|
|
3255
|
+
exploit_scenario: |-
|
|
3256
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3257
|
+
fix_template: |-
|
|
3258
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3259
|
+
pattern-either:
|
|
3260
|
+
- pattern: |-
|
|
3261
|
+
go func(){ sharedCounter++ }()
|
|
3262
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-216\\b'
|
|
3263
|
+
message: |-
|
|
3264
|
+
RunSec Detection [GOX-216]: CWE-662
|
|
3265
|
+
languages:
|
|
3266
|
+
- go
|
|
3267
|
+
severity: WARNING
|
|
3268
|
+
- id: runsec.go-core.gox-217
|
|
3269
|
+
metadata:
|
|
3270
|
+
runsec_version: v1.0
|
|
3271
|
+
confidence: |-
|
|
3272
|
+
0.9
|
|
3273
|
+
exploit_scenario: |-
|
|
3274
|
+
Nil interface panic causes request crash and availability impact.
|
|
3275
|
+
fix_template: |-
|
|
3276
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3277
|
+
pattern-either:
|
|
3278
|
+
- pattern: |-
|
|
3279
|
+
repo.GetUser(ctx, id)
|
|
3280
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-217\\b'
|
|
3281
|
+
message: |-
|
|
3282
|
+
RunSec Detection [GOX-217]: CWE-476
|
|
3283
|
+
languages:
|
|
3284
|
+
- go
|
|
3285
|
+
severity: WARNING
|
|
3286
|
+
- id: runsec.go-core.gox-218
|
|
3287
|
+
metadata:
|
|
3288
|
+
runsec_version: v1.0
|
|
3289
|
+
confidence: |-
|
|
3290
|
+
0.9
|
|
3291
|
+
exploit_scenario: |-
|
|
3292
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3293
|
+
fix_template: |-
|
|
3294
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3295
|
+
pattern-either:
|
|
3296
|
+
- pattern: |-
|
|
3297
|
+
orderID := r.URL.Query().Get("id")
|
|
3298
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-218\\b'
|
|
3299
|
+
message: |-
|
|
3300
|
+
RunSec Detection [GOX-218]: CWE-639
|
|
3301
|
+
languages:
|
|
3302
|
+
- go
|
|
3303
|
+
severity: WARNING
|
|
3304
|
+
- id: runsec.go-core.gox-219
|
|
3305
|
+
metadata:
|
|
3306
|
+
runsec_version: v1.0
|
|
3307
|
+
confidence: |-
|
|
3308
|
+
0.9
|
|
3309
|
+
exploit_scenario: |-
|
|
3310
|
+
Untrusted keys can alter privilege-related fields.
|
|
3311
|
+
fix_template: |-
|
|
3312
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3313
|
+
pattern-either:
|
|
3314
|
+
- pattern: |-
|
|
3315
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3316
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-219\\b'
|
|
3317
|
+
message: |-
|
|
3318
|
+
RunSec Detection [GOX-219]: CWE-915
|
|
3319
|
+
languages:
|
|
3320
|
+
- go
|
|
3321
|
+
severity: WARNING
|
|
3322
|
+
- id: runsec.go-core.gox-220
|
|
3323
|
+
metadata:
|
|
3324
|
+
runsec_version: v1.0
|
|
3325
|
+
confidence: |-
|
|
3326
|
+
0.9
|
|
3327
|
+
exploit_scenario: |-
|
|
3328
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3329
|
+
fix_template: |-
|
|
3330
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3331
|
+
pattern-either:
|
|
3332
|
+
- pattern: |-
|
|
3333
|
+
go worker(task)
|
|
3334
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-220\\b'
|
|
3335
|
+
message: |-
|
|
3336
|
+
RunSec Detection [GOX-220]: CWE-667
|
|
3337
|
+
languages:
|
|
3338
|
+
- go
|
|
3339
|
+
severity: WARNING
|
|
3340
|
+
- id: runsec.go-core.gox-221
|
|
3341
|
+
metadata:
|
|
3342
|
+
runsec_version: v1.0
|
|
3343
|
+
confidence: |-
|
|
3344
|
+
0.9
|
|
3345
|
+
exploit_scenario: |-
|
|
3346
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3347
|
+
fix_template: |-
|
|
3348
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3349
|
+
pattern-either:
|
|
3350
|
+
- pattern: |-
|
|
3351
|
+
go func(){ sharedCounter++ }()
|
|
3352
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-221\\b'
|
|
3353
|
+
message: |-
|
|
3354
|
+
RunSec Detection [GOX-221]: CWE-662
|
|
3355
|
+
languages:
|
|
3356
|
+
- go
|
|
3357
|
+
severity: WARNING
|
|
3358
|
+
- id: runsec.go-core.gox-222
|
|
3359
|
+
metadata:
|
|
3360
|
+
runsec_version: v1.0
|
|
3361
|
+
confidence: |-
|
|
3362
|
+
0.9
|
|
3363
|
+
exploit_scenario: |-
|
|
3364
|
+
Nil interface panic causes request crash and availability impact.
|
|
3365
|
+
fix_template: |-
|
|
3366
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3367
|
+
pattern-either:
|
|
3368
|
+
- pattern: |-
|
|
3369
|
+
repo.GetUser(ctx, id)
|
|
3370
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-222\\b'
|
|
3371
|
+
message: |-
|
|
3372
|
+
RunSec Detection [GOX-222]: CWE-476
|
|
3373
|
+
languages:
|
|
3374
|
+
- go
|
|
3375
|
+
severity: WARNING
|
|
3376
|
+
- id: runsec.go-core.gox-223
|
|
3377
|
+
metadata:
|
|
3378
|
+
runsec_version: v1.0
|
|
3379
|
+
confidence: |-
|
|
3380
|
+
0.9
|
|
3381
|
+
exploit_scenario: |-
|
|
3382
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3383
|
+
fix_template: |-
|
|
3384
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3385
|
+
pattern-either:
|
|
3386
|
+
- pattern: |-
|
|
3387
|
+
orderID := r.URL.Query().Get("id")
|
|
3388
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-223\\b'
|
|
3389
|
+
message: |-
|
|
3390
|
+
RunSec Detection [GOX-223]: CWE-639
|
|
3391
|
+
languages:
|
|
3392
|
+
- go
|
|
3393
|
+
severity: WARNING
|
|
3394
|
+
- id: runsec.go-core.gox-224
|
|
3395
|
+
metadata:
|
|
3396
|
+
runsec_version: v1.0
|
|
3397
|
+
confidence: |-
|
|
3398
|
+
0.9
|
|
3399
|
+
exploit_scenario: |-
|
|
3400
|
+
Untrusted keys can alter privilege-related fields.
|
|
3401
|
+
fix_template: |-
|
|
3402
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3403
|
+
pattern-either:
|
|
3404
|
+
- pattern: |-
|
|
3405
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3406
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-224\\b'
|
|
3407
|
+
message: |-
|
|
3408
|
+
RunSec Detection [GOX-224]: CWE-915
|
|
3409
|
+
languages:
|
|
3410
|
+
- go
|
|
3411
|
+
severity: WARNING
|
|
3412
|
+
- id: runsec.go-core.gox-225
|
|
3413
|
+
metadata:
|
|
3414
|
+
runsec_version: v1.0
|
|
3415
|
+
confidence: |-
|
|
3416
|
+
0.9
|
|
3417
|
+
exploit_scenario: |-
|
|
3418
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3419
|
+
fix_template: |-
|
|
3420
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3421
|
+
pattern-either:
|
|
3422
|
+
- pattern: |-
|
|
3423
|
+
go worker(task)
|
|
3424
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-225\\b'
|
|
3425
|
+
message: |-
|
|
3426
|
+
RunSec Detection [GOX-225]: CWE-667
|
|
3427
|
+
languages:
|
|
3428
|
+
- go
|
|
3429
|
+
severity: WARNING
|
|
3430
|
+
- id: runsec.go-core.gox-226
|
|
3431
|
+
metadata:
|
|
3432
|
+
runsec_version: v1.0
|
|
3433
|
+
confidence: |-
|
|
3434
|
+
0.9
|
|
3435
|
+
exploit_scenario: |-
|
|
3436
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3437
|
+
fix_template: |-
|
|
3438
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3439
|
+
pattern-either:
|
|
3440
|
+
- pattern: |-
|
|
3441
|
+
go func(){ sharedCounter++ }()
|
|
3442
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-226\\b'
|
|
3443
|
+
message: |-
|
|
3444
|
+
RunSec Detection [GOX-226]: CWE-662
|
|
3445
|
+
languages:
|
|
3446
|
+
- go
|
|
3447
|
+
severity: WARNING
|
|
3448
|
+
- id: runsec.go-core.gox-227
|
|
3449
|
+
metadata:
|
|
3450
|
+
runsec_version: v1.0
|
|
3451
|
+
confidence: |-
|
|
3452
|
+
0.9
|
|
3453
|
+
exploit_scenario: |-
|
|
3454
|
+
Nil interface panic causes request crash and availability impact.
|
|
3455
|
+
fix_template: |-
|
|
3456
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3457
|
+
pattern-either:
|
|
3458
|
+
- pattern: |-
|
|
3459
|
+
repo.GetUser(ctx, id)
|
|
3460
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-227\\b'
|
|
3461
|
+
message: |-
|
|
3462
|
+
RunSec Detection [GOX-227]: CWE-476
|
|
3463
|
+
languages:
|
|
3464
|
+
- go
|
|
3465
|
+
severity: WARNING
|
|
3466
|
+
- id: runsec.go-core.gox-228
|
|
3467
|
+
metadata:
|
|
3468
|
+
runsec_version: v1.0
|
|
3469
|
+
confidence: |-
|
|
3470
|
+
0.9
|
|
3471
|
+
exploit_scenario: |-
|
|
3472
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3473
|
+
fix_template: |-
|
|
3474
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3475
|
+
pattern-either:
|
|
3476
|
+
- pattern: |-
|
|
3477
|
+
orderID := r.URL.Query().Get("id")
|
|
3478
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-228\\b'
|
|
3479
|
+
message: |-
|
|
3480
|
+
RunSec Detection [GOX-228]: CWE-639
|
|
3481
|
+
languages:
|
|
3482
|
+
- go
|
|
3483
|
+
severity: WARNING
|
|
3484
|
+
- id: runsec.go-core.gox-229
|
|
3485
|
+
metadata:
|
|
3486
|
+
runsec_version: v1.0
|
|
3487
|
+
confidence: |-
|
|
3488
|
+
0.9
|
|
3489
|
+
exploit_scenario: |-
|
|
3490
|
+
Untrusted keys can alter privilege-related fields.
|
|
3491
|
+
fix_template: |-
|
|
3492
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3493
|
+
pattern-either:
|
|
3494
|
+
- pattern: |-
|
|
3495
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3496
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-229\\b'
|
|
3497
|
+
message: |-
|
|
3498
|
+
RunSec Detection [GOX-229]: CWE-915
|
|
3499
|
+
languages:
|
|
3500
|
+
- go
|
|
3501
|
+
severity: WARNING
|
|
3502
|
+
- id: runsec.go-core.gox-230
|
|
3503
|
+
metadata:
|
|
3504
|
+
runsec_version: v1.0
|
|
3505
|
+
confidence: |-
|
|
3506
|
+
0.9
|
|
3507
|
+
exploit_scenario: |-
|
|
3508
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3509
|
+
fix_template: |-
|
|
3510
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3511
|
+
pattern-either:
|
|
3512
|
+
- pattern: |-
|
|
3513
|
+
go worker(task)
|
|
3514
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-230\\b'
|
|
3515
|
+
message: |-
|
|
3516
|
+
RunSec Detection [GOX-230]: CWE-667
|
|
3517
|
+
languages:
|
|
3518
|
+
- go
|
|
3519
|
+
severity: WARNING
|
|
3520
|
+
- id: runsec.go-core.gox-231
|
|
3521
|
+
metadata:
|
|
3522
|
+
runsec_version: v1.0
|
|
3523
|
+
confidence: |-
|
|
3524
|
+
0.9
|
|
3525
|
+
exploit_scenario: |-
|
|
3526
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3527
|
+
fix_template: |-
|
|
3528
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3529
|
+
pattern-either:
|
|
3530
|
+
- pattern: |-
|
|
3531
|
+
go func(){ sharedCounter++ }()
|
|
3532
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-231\\b'
|
|
3533
|
+
message: |-
|
|
3534
|
+
RunSec Detection [GOX-231]: CWE-662
|
|
3535
|
+
languages:
|
|
3536
|
+
- go
|
|
3537
|
+
severity: WARNING
|
|
3538
|
+
- id: runsec.go-core.gox-232
|
|
3539
|
+
metadata:
|
|
3540
|
+
runsec_version: v1.0
|
|
3541
|
+
confidence: |-
|
|
3542
|
+
0.9
|
|
3543
|
+
exploit_scenario: |-
|
|
3544
|
+
Nil interface panic causes request crash and availability impact.
|
|
3545
|
+
fix_template: |-
|
|
3546
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3547
|
+
pattern-either:
|
|
3548
|
+
- pattern: |-
|
|
3549
|
+
repo.GetUser(ctx, id)
|
|
3550
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-232\\b'
|
|
3551
|
+
message: |-
|
|
3552
|
+
RunSec Detection [GOX-232]: CWE-476
|
|
3553
|
+
languages:
|
|
3554
|
+
- go
|
|
3555
|
+
severity: WARNING
|
|
3556
|
+
- id: runsec.go-core.gox-233
|
|
3557
|
+
metadata:
|
|
3558
|
+
runsec_version: v1.0
|
|
3559
|
+
confidence: |-
|
|
3560
|
+
0.9
|
|
3561
|
+
exploit_scenario: |-
|
|
3562
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3563
|
+
fix_template: |-
|
|
3564
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3565
|
+
pattern-either:
|
|
3566
|
+
- pattern: |-
|
|
3567
|
+
orderID := r.URL.Query().Get("id")
|
|
3568
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-233\\b'
|
|
3569
|
+
message: |-
|
|
3570
|
+
RunSec Detection [GOX-233]: CWE-639
|
|
3571
|
+
languages:
|
|
3572
|
+
- go
|
|
3573
|
+
severity: WARNING
|
|
3574
|
+
- id: runsec.go-core.gox-234
|
|
3575
|
+
metadata:
|
|
3576
|
+
runsec_version: v1.0
|
|
3577
|
+
confidence: |-
|
|
3578
|
+
0.9
|
|
3579
|
+
exploit_scenario: |-
|
|
3580
|
+
Untrusted keys can alter privilege-related fields.
|
|
3581
|
+
fix_template: |-
|
|
3582
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3583
|
+
pattern-either:
|
|
3584
|
+
- pattern: |-
|
|
3585
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3586
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-234\\b'
|
|
3587
|
+
message: |-
|
|
3588
|
+
RunSec Detection [GOX-234]: CWE-915
|
|
3589
|
+
languages:
|
|
3590
|
+
- go
|
|
3591
|
+
severity: WARNING
|
|
3592
|
+
- id: runsec.go-core.gox-235
|
|
3593
|
+
metadata:
|
|
3594
|
+
runsec_version: v1.0
|
|
3595
|
+
confidence: |-
|
|
3596
|
+
0.9
|
|
3597
|
+
exploit_scenario: |-
|
|
3598
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3599
|
+
fix_template: |-
|
|
3600
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3601
|
+
pattern-either:
|
|
3602
|
+
- pattern: |-
|
|
3603
|
+
go worker(task)
|
|
3604
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-235\\b'
|
|
3605
|
+
message: |-
|
|
3606
|
+
RunSec Detection [GOX-235]: CWE-667
|
|
3607
|
+
languages:
|
|
3608
|
+
- go
|
|
3609
|
+
severity: WARNING
|
|
3610
|
+
- id: runsec.go-core.gox-236
|
|
3611
|
+
metadata:
|
|
3612
|
+
runsec_version: v1.0
|
|
3613
|
+
confidence: |-
|
|
3614
|
+
0.9
|
|
3615
|
+
exploit_scenario: |-
|
|
3616
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3617
|
+
fix_template: |-
|
|
3618
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3619
|
+
pattern-either:
|
|
3620
|
+
- pattern: |-
|
|
3621
|
+
go func(){ sharedCounter++ }()
|
|
3622
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-236\\b'
|
|
3623
|
+
message: |-
|
|
3624
|
+
RunSec Detection [GOX-236]: CWE-662
|
|
3625
|
+
languages:
|
|
3626
|
+
- go
|
|
3627
|
+
severity: WARNING
|
|
3628
|
+
- id: runsec.go-core.gox-237
|
|
3629
|
+
metadata:
|
|
3630
|
+
runsec_version: v1.0
|
|
3631
|
+
confidence: |-
|
|
3632
|
+
0.9
|
|
3633
|
+
exploit_scenario: |-
|
|
3634
|
+
Nil interface panic causes request crash and availability impact.
|
|
3635
|
+
fix_template: |-
|
|
3636
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3637
|
+
pattern-either:
|
|
3638
|
+
- pattern: |-
|
|
3639
|
+
repo.GetUser(ctx, id)
|
|
3640
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-237\\b'
|
|
3641
|
+
message: |-
|
|
3642
|
+
RunSec Detection [GOX-237]: CWE-476
|
|
3643
|
+
languages:
|
|
3644
|
+
- go
|
|
3645
|
+
severity: WARNING
|
|
3646
|
+
- id: runsec.go-core.gox-238
|
|
3647
|
+
metadata:
|
|
3648
|
+
runsec_version: v1.0
|
|
3649
|
+
confidence: |-
|
|
3650
|
+
0.9
|
|
3651
|
+
exploit_scenario: |-
|
|
3652
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3653
|
+
fix_template: |-
|
|
3654
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3655
|
+
pattern-either:
|
|
3656
|
+
- pattern: |-
|
|
3657
|
+
orderID := r.URL.Query().Get("id")
|
|
3658
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-238\\b'
|
|
3659
|
+
message: |-
|
|
3660
|
+
RunSec Detection [GOX-238]: CWE-639
|
|
3661
|
+
languages:
|
|
3662
|
+
- go
|
|
3663
|
+
severity: WARNING
|
|
3664
|
+
- id: runsec.go-core.gox-239
|
|
3665
|
+
metadata:
|
|
3666
|
+
runsec_version: v1.0
|
|
3667
|
+
confidence: |-
|
|
3668
|
+
0.9
|
|
3669
|
+
exploit_scenario: |-
|
|
3670
|
+
Untrusted keys can alter privilege-related fields.
|
|
3671
|
+
fix_template: |-
|
|
3672
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3673
|
+
pattern-either:
|
|
3674
|
+
- pattern: |-
|
|
3675
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3676
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-239\\b'
|
|
3677
|
+
message: |-
|
|
3678
|
+
RunSec Detection [GOX-239]: CWE-915
|
|
3679
|
+
languages:
|
|
3680
|
+
- go
|
|
3681
|
+
severity: WARNING
|
|
3682
|
+
- id: runsec.go-core.gox-240
|
|
3683
|
+
metadata:
|
|
3684
|
+
runsec_version: v1.0
|
|
3685
|
+
confidence: |-
|
|
3686
|
+
0.9
|
|
3687
|
+
exploit_scenario: |-
|
|
3688
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3689
|
+
fix_template: |-
|
|
3690
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3691
|
+
pattern-either:
|
|
3692
|
+
- pattern: |-
|
|
3693
|
+
go worker(task)
|
|
3694
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-240\\b'
|
|
3695
|
+
message: |-
|
|
3696
|
+
RunSec Detection [GOX-240]: CWE-667
|
|
3697
|
+
languages:
|
|
3698
|
+
- go
|
|
3699
|
+
severity: WARNING
|
|
3700
|
+
- id: runsec.go-core.gox-241
|
|
3701
|
+
metadata:
|
|
3702
|
+
runsec_version: v1.0
|
|
3703
|
+
confidence: |-
|
|
3704
|
+
0.9
|
|
3705
|
+
exploit_scenario: |-
|
|
3706
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3707
|
+
fix_template: |-
|
|
3708
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3709
|
+
pattern-either:
|
|
3710
|
+
- pattern: |-
|
|
3711
|
+
go func(){ sharedCounter++ }()
|
|
3712
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-241\\b'
|
|
3713
|
+
message: |-
|
|
3714
|
+
RunSec Detection [GOX-241]: CWE-662
|
|
3715
|
+
languages:
|
|
3716
|
+
- go
|
|
3717
|
+
severity: WARNING
|
|
3718
|
+
- id: runsec.go-core.gox-242
|
|
3719
|
+
metadata:
|
|
3720
|
+
runsec_version: v1.0
|
|
3721
|
+
confidence: |-
|
|
3722
|
+
0.9
|
|
3723
|
+
exploit_scenario: |-
|
|
3724
|
+
Nil interface panic causes request crash and availability impact.
|
|
3725
|
+
fix_template: |-
|
|
3726
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3727
|
+
pattern-either:
|
|
3728
|
+
- pattern: |-
|
|
3729
|
+
repo.GetUser(ctx, id)
|
|
3730
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-242\\b'
|
|
3731
|
+
message: |-
|
|
3732
|
+
RunSec Detection [GOX-242]: CWE-476
|
|
3733
|
+
languages:
|
|
3734
|
+
- go
|
|
3735
|
+
severity: WARNING
|
|
3736
|
+
- id: runsec.go-core.gox-243
|
|
3737
|
+
metadata:
|
|
3738
|
+
runsec_version: v1.0
|
|
3739
|
+
confidence: |-
|
|
3740
|
+
0.9
|
|
3741
|
+
exploit_scenario: |-
|
|
3742
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3743
|
+
fix_template: |-
|
|
3744
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3745
|
+
pattern-either:
|
|
3746
|
+
- pattern: |-
|
|
3747
|
+
orderID := r.URL.Query().Get("id")
|
|
3748
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-243\\b'
|
|
3749
|
+
message: |-
|
|
3750
|
+
RunSec Detection [GOX-243]: CWE-639
|
|
3751
|
+
languages:
|
|
3752
|
+
- go
|
|
3753
|
+
severity: WARNING
|
|
3754
|
+
- id: runsec.go-core.gox-244
|
|
3755
|
+
metadata:
|
|
3756
|
+
runsec_version: v1.0
|
|
3757
|
+
confidence: |-
|
|
3758
|
+
0.9
|
|
3759
|
+
exploit_scenario: |-
|
|
3760
|
+
Untrusted keys can alter privilege-related fields.
|
|
3761
|
+
fix_template: |-
|
|
3762
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3763
|
+
pattern-either:
|
|
3764
|
+
- pattern: |-
|
|
3765
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3766
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-244\\b'
|
|
3767
|
+
message: |-
|
|
3768
|
+
RunSec Detection [GOX-244]: CWE-915
|
|
3769
|
+
languages:
|
|
3770
|
+
- go
|
|
3771
|
+
severity: WARNING
|
|
3772
|
+
- id: runsec.go-core.gox-245
|
|
3773
|
+
metadata:
|
|
3774
|
+
runsec_version: v1.0
|
|
3775
|
+
confidence: |-
|
|
3776
|
+
0.9
|
|
3777
|
+
exploit_scenario: |-
|
|
3778
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3779
|
+
fix_template: |-
|
|
3780
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3781
|
+
pattern-either:
|
|
3782
|
+
- pattern: |-
|
|
3783
|
+
go worker(task)
|
|
3784
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-245\\b'
|
|
3785
|
+
message: |-
|
|
3786
|
+
RunSec Detection [GOX-245]: CWE-667
|
|
3787
|
+
languages:
|
|
3788
|
+
- go
|
|
3789
|
+
severity: WARNING
|
|
3790
|
+
- id: runsec.go-core.gox-246
|
|
3791
|
+
metadata:
|
|
3792
|
+
runsec_version: v1.0
|
|
3793
|
+
confidence: |-
|
|
3794
|
+
0.9
|
|
3795
|
+
exploit_scenario: |-
|
|
3796
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3797
|
+
fix_template: |-
|
|
3798
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3799
|
+
pattern-either:
|
|
3800
|
+
- pattern: |-
|
|
3801
|
+
go func(){ sharedCounter++ }()
|
|
3802
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-246\\b'
|
|
3803
|
+
message: |-
|
|
3804
|
+
RunSec Detection [GOX-246]: CWE-662
|
|
3805
|
+
languages:
|
|
3806
|
+
- go
|
|
3807
|
+
severity: WARNING
|
|
3808
|
+
- id: runsec.go-core.gox-247
|
|
3809
|
+
metadata:
|
|
3810
|
+
runsec_version: v1.0
|
|
3811
|
+
confidence: |-
|
|
3812
|
+
0.9
|
|
3813
|
+
exploit_scenario: |-
|
|
3814
|
+
Nil interface panic causes request crash and availability impact.
|
|
3815
|
+
fix_template: |-
|
|
3816
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3817
|
+
pattern-either:
|
|
3818
|
+
- pattern: |-
|
|
3819
|
+
repo.GetUser(ctx, id)
|
|
3820
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-247\\b'
|
|
3821
|
+
message: |-
|
|
3822
|
+
RunSec Detection [GOX-247]: CWE-476
|
|
3823
|
+
languages:
|
|
3824
|
+
- go
|
|
3825
|
+
severity: WARNING
|
|
3826
|
+
- id: runsec.go-core.gox-248
|
|
3827
|
+
metadata:
|
|
3828
|
+
runsec_version: v1.0
|
|
3829
|
+
confidence: |-
|
|
3830
|
+
0.9
|
|
3831
|
+
exploit_scenario: |-
|
|
3832
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3833
|
+
fix_template: |-
|
|
3834
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3835
|
+
pattern-either:
|
|
3836
|
+
- pattern: |-
|
|
3837
|
+
orderID := r.URL.Query().Get("id")
|
|
3838
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-248\\b'
|
|
3839
|
+
message: |-
|
|
3840
|
+
RunSec Detection [GOX-248]: CWE-639
|
|
3841
|
+
languages:
|
|
3842
|
+
- go
|
|
3843
|
+
severity: WARNING
|
|
3844
|
+
- id: runsec.go-core.gox-249
|
|
3845
|
+
metadata:
|
|
3846
|
+
runsec_version: v1.0
|
|
3847
|
+
confidence: |-
|
|
3848
|
+
0.9
|
|
3849
|
+
exploit_scenario: |-
|
|
3850
|
+
Untrusted keys can alter privilege-related fields.
|
|
3851
|
+
fix_template: |-
|
|
3852
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3853
|
+
pattern-either:
|
|
3854
|
+
- pattern: |-
|
|
3855
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3856
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-249\\b'
|
|
3857
|
+
message: |-
|
|
3858
|
+
RunSec Detection [GOX-249]: CWE-915
|
|
3859
|
+
languages:
|
|
3860
|
+
- go
|
|
3861
|
+
severity: WARNING
|
|
3862
|
+
- id: runsec.go-core.gox-250
|
|
3863
|
+
metadata:
|
|
3864
|
+
runsec_version: v1.0
|
|
3865
|
+
confidence: |-
|
|
3866
|
+
0.9
|
|
3867
|
+
exploit_scenario: |-
|
|
3868
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3869
|
+
fix_template: |-
|
|
3870
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3871
|
+
pattern-either:
|
|
3872
|
+
- pattern: |-
|
|
3873
|
+
go worker(task)
|
|
3874
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-250\\b'
|
|
3875
|
+
message: |-
|
|
3876
|
+
RunSec Detection [GOX-250]: CWE-667
|
|
3877
|
+
languages:
|
|
3878
|
+
- go
|
|
3879
|
+
severity: WARNING
|
|
3880
|
+
- id: runsec.go-core.gox-251
|
|
3881
|
+
metadata:
|
|
3882
|
+
runsec_version: v1.0
|
|
3883
|
+
confidence: |-
|
|
3884
|
+
0.9
|
|
3885
|
+
exploit_scenario: |-
|
|
3886
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3887
|
+
fix_template: |-
|
|
3888
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3889
|
+
pattern-either:
|
|
3890
|
+
- pattern: |-
|
|
3891
|
+
go func(){ sharedCounter++ }()
|
|
3892
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-251\\b'
|
|
3893
|
+
message: |-
|
|
3894
|
+
RunSec Detection [GOX-251]: CWE-662
|
|
3895
|
+
languages:
|
|
3896
|
+
- go
|
|
3897
|
+
severity: WARNING
|
|
3898
|
+
- id: runsec.go-core.gox-252
|
|
3899
|
+
metadata:
|
|
3900
|
+
runsec_version: v1.0
|
|
3901
|
+
confidence: |-
|
|
3902
|
+
0.9
|
|
3903
|
+
exploit_scenario: |-
|
|
3904
|
+
Nil interface panic causes request crash and availability impact.
|
|
3905
|
+
fix_template: |-
|
|
3906
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3907
|
+
pattern-either:
|
|
3908
|
+
- pattern: |-
|
|
3909
|
+
repo.GetUser(ctx, id)
|
|
3910
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-252\\b'
|
|
3911
|
+
message: |-
|
|
3912
|
+
RunSec Detection [GOX-252]: CWE-476
|
|
3913
|
+
languages:
|
|
3914
|
+
- go
|
|
3915
|
+
severity: WARNING
|
|
3916
|
+
- id: runsec.go-core.gox-253
|
|
3917
|
+
metadata:
|
|
3918
|
+
runsec_version: v1.0
|
|
3919
|
+
confidence: |-
|
|
3920
|
+
0.9
|
|
3921
|
+
exploit_scenario: |-
|
|
3922
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
3923
|
+
fix_template: |-
|
|
3924
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
3925
|
+
pattern-either:
|
|
3926
|
+
- pattern: |-
|
|
3927
|
+
orderID := r.URL.Query().Get("id")
|
|
3928
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-253\\b'
|
|
3929
|
+
message: |-
|
|
3930
|
+
RunSec Detection [GOX-253]: CWE-639
|
|
3931
|
+
languages:
|
|
3932
|
+
- go
|
|
3933
|
+
severity: WARNING
|
|
3934
|
+
- id: runsec.go-core.gox-254
|
|
3935
|
+
metadata:
|
|
3936
|
+
runsec_version: v1.0
|
|
3937
|
+
confidence: |-
|
|
3938
|
+
0.9
|
|
3939
|
+
exploit_scenario: |-
|
|
3940
|
+
Untrusted keys can alter privilege-related fields.
|
|
3941
|
+
fix_template: |-
|
|
3942
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
3943
|
+
pattern-either:
|
|
3944
|
+
- pattern: |-
|
|
3945
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
3946
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-254\\b'
|
|
3947
|
+
message: |-
|
|
3948
|
+
RunSec Detection [GOX-254]: CWE-915
|
|
3949
|
+
languages:
|
|
3950
|
+
- go
|
|
3951
|
+
severity: WARNING
|
|
3952
|
+
- id: runsec.go-core.gox-255
|
|
3953
|
+
metadata:
|
|
3954
|
+
runsec_version: v1.0
|
|
3955
|
+
confidence: |-
|
|
3956
|
+
0.9
|
|
3957
|
+
exploit_scenario: |-
|
|
3958
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
3959
|
+
fix_template: |-
|
|
3960
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
3961
|
+
pattern-either:
|
|
3962
|
+
- pattern: |-
|
|
3963
|
+
go worker(task)
|
|
3964
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-255\\b'
|
|
3965
|
+
message: |-
|
|
3966
|
+
RunSec Detection [GOX-255]: CWE-667
|
|
3967
|
+
languages:
|
|
3968
|
+
- go
|
|
3969
|
+
severity: WARNING
|
|
3970
|
+
- id: runsec.go-core.gox-256
|
|
3971
|
+
metadata:
|
|
3972
|
+
runsec_version: v1.0
|
|
3973
|
+
confidence: |-
|
|
3974
|
+
0.9
|
|
3975
|
+
exploit_scenario: |-
|
|
3976
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
3977
|
+
fix_template: |-
|
|
3978
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
3979
|
+
pattern-either:
|
|
3980
|
+
- pattern: |-
|
|
3981
|
+
go func(){ sharedCounter++ }()
|
|
3982
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-256\\b'
|
|
3983
|
+
message: |-
|
|
3984
|
+
RunSec Detection [GOX-256]: CWE-662
|
|
3985
|
+
languages:
|
|
3986
|
+
- go
|
|
3987
|
+
severity: WARNING
|
|
3988
|
+
- id: runsec.go-core.gox-257
|
|
3989
|
+
metadata:
|
|
3990
|
+
runsec_version: v1.0
|
|
3991
|
+
confidence: |-
|
|
3992
|
+
0.9
|
|
3993
|
+
exploit_scenario: |-
|
|
3994
|
+
Nil interface panic causes request crash and availability impact.
|
|
3995
|
+
fix_template: |-
|
|
3996
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
3997
|
+
pattern-either:
|
|
3998
|
+
- pattern: |-
|
|
3999
|
+
repo.GetUser(ctx, id)
|
|
4000
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-257\\b'
|
|
4001
|
+
message: |-
|
|
4002
|
+
RunSec Detection [GOX-257]: CWE-476
|
|
4003
|
+
languages:
|
|
4004
|
+
- go
|
|
4005
|
+
severity: WARNING
|
|
4006
|
+
- id: runsec.go-core.gox-258
|
|
4007
|
+
metadata:
|
|
4008
|
+
runsec_version: v1.0
|
|
4009
|
+
confidence: |-
|
|
4010
|
+
0.9
|
|
4011
|
+
exploit_scenario: |-
|
|
4012
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4013
|
+
fix_template: |-
|
|
4014
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4015
|
+
pattern-either:
|
|
4016
|
+
- pattern: |-
|
|
4017
|
+
orderID := r.URL.Query().Get("id")
|
|
4018
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-258\\b'
|
|
4019
|
+
message: |-
|
|
4020
|
+
RunSec Detection [GOX-258]: CWE-639
|
|
4021
|
+
languages:
|
|
4022
|
+
- go
|
|
4023
|
+
severity: WARNING
|
|
4024
|
+
- id: runsec.go-core.gox-259
|
|
4025
|
+
metadata:
|
|
4026
|
+
runsec_version: v1.0
|
|
4027
|
+
confidence: |-
|
|
4028
|
+
0.9
|
|
4029
|
+
exploit_scenario: |-
|
|
4030
|
+
Untrusted keys can alter privilege-related fields.
|
|
4031
|
+
fix_template: |-
|
|
4032
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4033
|
+
pattern-either:
|
|
4034
|
+
- pattern: |-
|
|
4035
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4036
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-259\\b'
|
|
4037
|
+
message: |-
|
|
4038
|
+
RunSec Detection [GOX-259]: CWE-915
|
|
4039
|
+
languages:
|
|
4040
|
+
- go
|
|
4041
|
+
severity: WARNING
|
|
4042
|
+
- id: runsec.go-core.gox-260
|
|
4043
|
+
metadata:
|
|
4044
|
+
runsec_version: v1.0
|
|
4045
|
+
confidence: |-
|
|
4046
|
+
0.9
|
|
4047
|
+
exploit_scenario: |-
|
|
4048
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4049
|
+
fix_template: |-
|
|
4050
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4051
|
+
pattern-either:
|
|
4052
|
+
- pattern: |-
|
|
4053
|
+
go worker(task)
|
|
4054
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-260\\b'
|
|
4055
|
+
message: |-
|
|
4056
|
+
RunSec Detection [GOX-260]: CWE-667
|
|
4057
|
+
languages:
|
|
4058
|
+
- go
|
|
4059
|
+
severity: WARNING
|
|
4060
|
+
- id: runsec.go-core.gox-261
|
|
4061
|
+
metadata:
|
|
4062
|
+
runsec_version: v1.0
|
|
4063
|
+
confidence: |-
|
|
4064
|
+
0.9
|
|
4065
|
+
exploit_scenario: |-
|
|
4066
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
4067
|
+
fix_template: |-
|
|
4068
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
4069
|
+
pattern-either:
|
|
4070
|
+
- pattern: |-
|
|
4071
|
+
go func(){ sharedCounter++ }()
|
|
4072
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-261\\b'
|
|
4073
|
+
message: |-
|
|
4074
|
+
RunSec Detection [GOX-261]: CWE-662
|
|
4075
|
+
languages:
|
|
4076
|
+
- go
|
|
4077
|
+
severity: WARNING
|
|
4078
|
+
- id: runsec.go-core.gox-262
|
|
4079
|
+
metadata:
|
|
4080
|
+
runsec_version: v1.0
|
|
4081
|
+
confidence: |-
|
|
4082
|
+
0.9
|
|
4083
|
+
exploit_scenario: |-
|
|
4084
|
+
Nil interface panic causes request crash and availability impact.
|
|
4085
|
+
fix_template: |-
|
|
4086
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
4087
|
+
pattern-either:
|
|
4088
|
+
- pattern: |-
|
|
4089
|
+
repo.GetUser(ctx, id)
|
|
4090
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-262\\b'
|
|
4091
|
+
message: |-
|
|
4092
|
+
RunSec Detection [GOX-262]: CWE-476
|
|
4093
|
+
languages:
|
|
4094
|
+
- go
|
|
4095
|
+
severity: WARNING
|
|
4096
|
+
- id: runsec.go-core.gox-263
|
|
4097
|
+
metadata:
|
|
4098
|
+
runsec_version: v1.0
|
|
4099
|
+
confidence: |-
|
|
4100
|
+
0.9
|
|
4101
|
+
exploit_scenario: |-
|
|
4102
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4103
|
+
fix_template: |-
|
|
4104
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4105
|
+
pattern-either:
|
|
4106
|
+
- pattern: |-
|
|
4107
|
+
orderID := r.URL.Query().Get("id")
|
|
4108
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-263\\b'
|
|
4109
|
+
message: |-
|
|
4110
|
+
RunSec Detection [GOX-263]: CWE-639
|
|
4111
|
+
languages:
|
|
4112
|
+
- go
|
|
4113
|
+
severity: WARNING
|
|
4114
|
+
- id: runsec.go-core.gox-264
|
|
4115
|
+
metadata:
|
|
4116
|
+
runsec_version: v1.0
|
|
4117
|
+
confidence: |-
|
|
4118
|
+
0.9
|
|
4119
|
+
exploit_scenario: |-
|
|
4120
|
+
Untrusted keys can alter privilege-related fields.
|
|
4121
|
+
fix_template: |-
|
|
4122
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4123
|
+
pattern-either:
|
|
4124
|
+
- pattern: |-
|
|
4125
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4126
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-264\\b'
|
|
4127
|
+
message: |-
|
|
4128
|
+
RunSec Detection [GOX-264]: CWE-915
|
|
4129
|
+
languages:
|
|
4130
|
+
- go
|
|
4131
|
+
severity: WARNING
|
|
4132
|
+
- id: runsec.go-core.gox-265
|
|
4133
|
+
metadata:
|
|
4134
|
+
runsec_version: v1.0
|
|
4135
|
+
confidence: |-
|
|
4136
|
+
0.9
|
|
4137
|
+
exploit_scenario: |-
|
|
4138
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4139
|
+
fix_template: |-
|
|
4140
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4141
|
+
pattern-either:
|
|
4142
|
+
- pattern: |-
|
|
4143
|
+
go worker(task)
|
|
4144
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-265\\b'
|
|
4145
|
+
message: |-
|
|
4146
|
+
RunSec Detection [GOX-265]: CWE-667
|
|
4147
|
+
languages:
|
|
4148
|
+
- go
|
|
4149
|
+
severity: WARNING
|
|
4150
|
+
- id: runsec.go-core.gox-266
|
|
4151
|
+
metadata:
|
|
4152
|
+
runsec_version: v1.0
|
|
4153
|
+
confidence: |-
|
|
4154
|
+
0.9
|
|
4155
|
+
exploit_scenario: |-
|
|
4156
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
4157
|
+
fix_template: |-
|
|
4158
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
4159
|
+
pattern-either:
|
|
4160
|
+
- pattern: |-
|
|
4161
|
+
go func(){ sharedCounter++ }()
|
|
4162
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-266\\b'
|
|
4163
|
+
message: |-
|
|
4164
|
+
RunSec Detection [GOX-266]: CWE-662
|
|
4165
|
+
languages:
|
|
4166
|
+
- go
|
|
4167
|
+
severity: WARNING
|
|
4168
|
+
- id: runsec.go-core.gox-267
|
|
4169
|
+
metadata:
|
|
4170
|
+
runsec_version: v1.0
|
|
4171
|
+
confidence: |-
|
|
4172
|
+
0.9
|
|
4173
|
+
exploit_scenario: |-
|
|
4174
|
+
Nil interface panic causes request crash and availability impact.
|
|
4175
|
+
fix_template: |-
|
|
4176
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
4177
|
+
pattern-either:
|
|
4178
|
+
- pattern: |-
|
|
4179
|
+
repo.GetUser(ctx, id)
|
|
4180
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-267\\b'
|
|
4181
|
+
message: |-
|
|
4182
|
+
RunSec Detection [GOX-267]: CWE-476
|
|
4183
|
+
languages:
|
|
4184
|
+
- go
|
|
4185
|
+
severity: WARNING
|
|
4186
|
+
- id: runsec.go-core.gox-268
|
|
4187
|
+
metadata:
|
|
4188
|
+
runsec_version: v1.0
|
|
4189
|
+
confidence: |-
|
|
4190
|
+
0.9
|
|
4191
|
+
exploit_scenario: |-
|
|
4192
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4193
|
+
fix_template: |-
|
|
4194
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4195
|
+
pattern-either:
|
|
4196
|
+
- pattern: |-
|
|
4197
|
+
orderID := r.URL.Query().Get("id")
|
|
4198
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-268\\b'
|
|
4199
|
+
message: |-
|
|
4200
|
+
RunSec Detection [GOX-268]: CWE-639
|
|
4201
|
+
languages:
|
|
4202
|
+
- go
|
|
4203
|
+
severity: WARNING
|
|
4204
|
+
- id: runsec.go-core.gox-269
|
|
4205
|
+
metadata:
|
|
4206
|
+
runsec_version: v1.0
|
|
4207
|
+
confidence: |-
|
|
4208
|
+
0.9
|
|
4209
|
+
exploit_scenario: |-
|
|
4210
|
+
Untrusted keys can alter privilege-related fields.
|
|
4211
|
+
fix_template: |-
|
|
4212
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4213
|
+
pattern-either:
|
|
4214
|
+
- pattern: |-
|
|
4215
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4216
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-269\\b'
|
|
4217
|
+
message: |-
|
|
4218
|
+
RunSec Detection [GOX-269]: CWE-915
|
|
4219
|
+
languages:
|
|
4220
|
+
- go
|
|
4221
|
+
severity: WARNING
|
|
4222
|
+
- id: runsec.go-core.gox-270
|
|
4223
|
+
metadata:
|
|
4224
|
+
runsec_version: v1.0
|
|
4225
|
+
confidence: |-
|
|
4226
|
+
0.9
|
|
4227
|
+
exploit_scenario: |-
|
|
4228
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4229
|
+
fix_template: |-
|
|
4230
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4231
|
+
pattern-either:
|
|
4232
|
+
- pattern: |-
|
|
4233
|
+
go worker(task)
|
|
4234
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-270\\b'
|
|
4235
|
+
message: |-
|
|
4236
|
+
RunSec Detection [GOX-270]: CWE-667
|
|
4237
|
+
languages:
|
|
4238
|
+
- go
|
|
4239
|
+
severity: WARNING
|
|
4240
|
+
- id: runsec.go-core.gox-271
|
|
4241
|
+
metadata:
|
|
4242
|
+
runsec_version: v1.0
|
|
4243
|
+
confidence: |-
|
|
4244
|
+
0.9
|
|
4245
|
+
exploit_scenario: |-
|
|
4246
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
4247
|
+
fix_template: |-
|
|
4248
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
4249
|
+
pattern-either:
|
|
4250
|
+
- pattern: |-
|
|
4251
|
+
go func(){ sharedCounter++ }()
|
|
4252
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-271\\b'
|
|
4253
|
+
message: |-
|
|
4254
|
+
RunSec Detection [GOX-271]: CWE-662
|
|
4255
|
+
languages:
|
|
4256
|
+
- go
|
|
4257
|
+
severity: WARNING
|
|
4258
|
+
- id: runsec.go-core.gox-272
|
|
4259
|
+
metadata:
|
|
4260
|
+
runsec_version: v1.0
|
|
4261
|
+
confidence: |-
|
|
4262
|
+
0.9
|
|
4263
|
+
exploit_scenario: |-
|
|
4264
|
+
Nil interface panic causes request crash and availability impact.
|
|
4265
|
+
fix_template: |-
|
|
4266
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
4267
|
+
pattern-either:
|
|
4268
|
+
- pattern: |-
|
|
4269
|
+
repo.GetUser(ctx, id)
|
|
4270
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-272\\b'
|
|
4271
|
+
message: |-
|
|
4272
|
+
RunSec Detection [GOX-272]: CWE-476
|
|
4273
|
+
languages:
|
|
4274
|
+
- go
|
|
4275
|
+
severity: WARNING
|
|
4276
|
+
- id: runsec.go-core.gox-273
|
|
4277
|
+
metadata:
|
|
4278
|
+
runsec_version: v1.0
|
|
4279
|
+
confidence: |-
|
|
4280
|
+
0.9
|
|
4281
|
+
exploit_scenario: |-
|
|
4282
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4283
|
+
fix_template: |-
|
|
4284
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4285
|
+
pattern-either:
|
|
4286
|
+
- pattern: |-
|
|
4287
|
+
orderID := r.URL.Query().Get("id")
|
|
4288
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-273\\b'
|
|
4289
|
+
message: |-
|
|
4290
|
+
RunSec Detection [GOX-273]: CWE-639
|
|
4291
|
+
languages:
|
|
4292
|
+
- go
|
|
4293
|
+
severity: WARNING
|
|
4294
|
+
- id: runsec.go-core.gox-274
|
|
4295
|
+
metadata:
|
|
4296
|
+
runsec_version: v1.0
|
|
4297
|
+
confidence: |-
|
|
4298
|
+
0.9
|
|
4299
|
+
exploit_scenario: |-
|
|
4300
|
+
Untrusted keys can alter privilege-related fields.
|
|
4301
|
+
fix_template: |-
|
|
4302
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4303
|
+
pattern-either:
|
|
4304
|
+
- pattern: |-
|
|
4305
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4306
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-274\\b'
|
|
4307
|
+
message: |-
|
|
4308
|
+
RunSec Detection [GOX-274]: CWE-915
|
|
4309
|
+
languages:
|
|
4310
|
+
- go
|
|
4311
|
+
severity: WARNING
|
|
4312
|
+
- id: runsec.go-core.gox-275
|
|
4313
|
+
metadata:
|
|
4314
|
+
runsec_version: v1.0
|
|
4315
|
+
confidence: |-
|
|
4316
|
+
0.9
|
|
4317
|
+
exploit_scenario: |-
|
|
4318
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4319
|
+
fix_template: |-
|
|
4320
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4321
|
+
pattern-either:
|
|
4322
|
+
- pattern: |-
|
|
4323
|
+
go worker(task)
|
|
4324
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-275\\b'
|
|
4325
|
+
message: |-
|
|
4326
|
+
RunSec Detection [GOX-275]: CWE-667
|
|
4327
|
+
languages:
|
|
4328
|
+
- go
|
|
4329
|
+
severity: WARNING
|
|
4330
|
+
- id: runsec.go-core.gox-276
|
|
4331
|
+
metadata:
|
|
4332
|
+
runsec_version: v1.0
|
|
4333
|
+
confidence: |-
|
|
4334
|
+
0.9
|
|
4335
|
+
exploit_scenario: |-
|
|
4336
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
4337
|
+
fix_template: |-
|
|
4338
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
4339
|
+
pattern-either:
|
|
4340
|
+
- pattern: |-
|
|
4341
|
+
go func(){ sharedCounter++ }()
|
|
4342
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-276\\b'
|
|
4343
|
+
message: |-
|
|
4344
|
+
RunSec Detection [GOX-276]: CWE-662
|
|
4345
|
+
languages:
|
|
4346
|
+
- go
|
|
4347
|
+
severity: WARNING
|
|
4348
|
+
- id: runsec.go-core.gox-277
|
|
4349
|
+
metadata:
|
|
4350
|
+
runsec_version: v1.0
|
|
4351
|
+
confidence: |-
|
|
4352
|
+
0.9
|
|
4353
|
+
exploit_scenario: |-
|
|
4354
|
+
Nil interface panic causes request crash and availability impact.
|
|
4355
|
+
fix_template: |-
|
|
4356
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
4357
|
+
pattern-either:
|
|
4358
|
+
- pattern: |-
|
|
4359
|
+
repo.GetUser(ctx, id)
|
|
4360
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-277\\b'
|
|
4361
|
+
message: |-
|
|
4362
|
+
RunSec Detection [GOX-277]: CWE-476
|
|
4363
|
+
languages:
|
|
4364
|
+
- go
|
|
4365
|
+
severity: WARNING
|
|
4366
|
+
- id: runsec.go-core.gox-278
|
|
4367
|
+
metadata:
|
|
4368
|
+
runsec_version: v1.0
|
|
4369
|
+
confidence: |-
|
|
4370
|
+
0.9
|
|
4371
|
+
exploit_scenario: |-
|
|
4372
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4373
|
+
fix_template: |-
|
|
4374
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4375
|
+
pattern-either:
|
|
4376
|
+
- pattern: |-
|
|
4377
|
+
orderID := r.URL.Query().Get("id")
|
|
4378
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-278\\b'
|
|
4379
|
+
message: |-
|
|
4380
|
+
RunSec Detection [GOX-278]: CWE-639
|
|
4381
|
+
languages:
|
|
4382
|
+
- go
|
|
4383
|
+
severity: WARNING
|
|
4384
|
+
- id: runsec.go-core.gox-279
|
|
4385
|
+
metadata:
|
|
4386
|
+
runsec_version: v1.0
|
|
4387
|
+
confidence: |-
|
|
4388
|
+
0.9
|
|
4389
|
+
exploit_scenario: |-
|
|
4390
|
+
Untrusted keys can alter privilege-related fields.
|
|
4391
|
+
fix_template: |-
|
|
4392
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4393
|
+
pattern-either:
|
|
4394
|
+
- pattern: |-
|
|
4395
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4396
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-279\\b'
|
|
4397
|
+
message: |-
|
|
4398
|
+
RunSec Detection [GOX-279]: CWE-915
|
|
4399
|
+
languages:
|
|
4400
|
+
- go
|
|
4401
|
+
severity: WARNING
|
|
4402
|
+
- id: runsec.go-core.gox-280
|
|
4403
|
+
metadata:
|
|
4404
|
+
runsec_version: v1.0
|
|
4405
|
+
confidence: |-
|
|
4406
|
+
0.9
|
|
4407
|
+
exploit_scenario: |-
|
|
4408
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4409
|
+
fix_template: |-
|
|
4410
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4411
|
+
pattern-either:
|
|
4412
|
+
- pattern: |-
|
|
4413
|
+
go worker(task)
|
|
4414
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-280\\b'
|
|
4415
|
+
message: |-
|
|
4416
|
+
RunSec Detection [GOX-280]: CWE-667
|
|
4417
|
+
languages:
|
|
4418
|
+
- go
|
|
4419
|
+
severity: WARNING
|
|
4420
|
+
- id: runsec.go-core.gox-281
|
|
4421
|
+
metadata:
|
|
4422
|
+
runsec_version: v1.0
|
|
4423
|
+
confidence: |-
|
|
4424
|
+
0.9
|
|
4425
|
+
exploit_scenario: |-
|
|
4426
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
4427
|
+
fix_template: |-
|
|
4428
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
4429
|
+
pattern-either:
|
|
4430
|
+
- pattern: |-
|
|
4431
|
+
go func(){ sharedCounter++ }()
|
|
4432
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-281\\b'
|
|
4433
|
+
message: |-
|
|
4434
|
+
RunSec Detection [GOX-281]: CWE-662
|
|
4435
|
+
languages:
|
|
4436
|
+
- go
|
|
4437
|
+
severity: WARNING
|
|
4438
|
+
- id: runsec.go-core.gox-282
|
|
4439
|
+
metadata:
|
|
4440
|
+
runsec_version: v1.0
|
|
4441
|
+
confidence: |-
|
|
4442
|
+
0.9
|
|
4443
|
+
exploit_scenario: |-
|
|
4444
|
+
Nil interface panic causes request crash and availability impact.
|
|
4445
|
+
fix_template: |-
|
|
4446
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
4447
|
+
pattern-either:
|
|
4448
|
+
- pattern: |-
|
|
4449
|
+
repo.GetUser(ctx, id)
|
|
4450
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-282\\b'
|
|
4451
|
+
message: |-
|
|
4452
|
+
RunSec Detection [GOX-282]: CWE-476
|
|
4453
|
+
languages:
|
|
4454
|
+
- go
|
|
4455
|
+
severity: WARNING
|
|
4456
|
+
- id: runsec.go-core.gox-283
|
|
4457
|
+
metadata:
|
|
4458
|
+
runsec_version: v1.0
|
|
4459
|
+
confidence: |-
|
|
4460
|
+
0.9
|
|
4461
|
+
exploit_scenario: |-
|
|
4462
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4463
|
+
fix_template: |-
|
|
4464
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4465
|
+
pattern-either:
|
|
4466
|
+
- pattern: |-
|
|
4467
|
+
orderID := r.URL.Query().Get("id")
|
|
4468
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-283\\b'
|
|
4469
|
+
message: |-
|
|
4470
|
+
RunSec Detection [GOX-283]: CWE-639
|
|
4471
|
+
languages:
|
|
4472
|
+
- go
|
|
4473
|
+
severity: WARNING
|
|
4474
|
+
- id: runsec.go-core.gox-284
|
|
4475
|
+
metadata:
|
|
4476
|
+
runsec_version: v1.0
|
|
4477
|
+
confidence: |-
|
|
4478
|
+
0.9
|
|
4479
|
+
exploit_scenario: |-
|
|
4480
|
+
Untrusted keys can alter privilege-related fields.
|
|
4481
|
+
fix_template: |-
|
|
4482
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4483
|
+
pattern-either:
|
|
4484
|
+
- pattern: |-
|
|
4485
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4486
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-284\\b'
|
|
4487
|
+
message: |-
|
|
4488
|
+
RunSec Detection [GOX-284]: CWE-915
|
|
4489
|
+
languages:
|
|
4490
|
+
- go
|
|
4491
|
+
severity: WARNING
|
|
4492
|
+
- id: runsec.go-core.gox-285
|
|
4493
|
+
metadata:
|
|
4494
|
+
runsec_version: v1.0
|
|
4495
|
+
confidence: |-
|
|
4496
|
+
0.9
|
|
4497
|
+
exploit_scenario: |-
|
|
4498
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4499
|
+
fix_template: |-
|
|
4500
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4501
|
+
pattern-either:
|
|
4502
|
+
- pattern: |-
|
|
4503
|
+
go worker(task)
|
|
4504
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-285\\b'
|
|
4505
|
+
message: |-
|
|
4506
|
+
RunSec Detection [GOX-285]: CWE-667
|
|
4507
|
+
languages:
|
|
4508
|
+
- go
|
|
4509
|
+
severity: WARNING
|
|
4510
|
+
- id: runsec.go-core.gox-286
|
|
4511
|
+
metadata:
|
|
4512
|
+
runsec_version: v1.0
|
|
4513
|
+
confidence: |-
|
|
4514
|
+
0.9
|
|
4515
|
+
exploit_scenario: |-
|
|
4516
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
4517
|
+
fix_template: |-
|
|
4518
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
4519
|
+
pattern-either:
|
|
4520
|
+
- pattern: |-
|
|
4521
|
+
go func(){ sharedCounter++ }()
|
|
4522
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-286\\b'
|
|
4523
|
+
message: |-
|
|
4524
|
+
RunSec Detection [GOX-286]: CWE-662
|
|
4525
|
+
languages:
|
|
4526
|
+
- go
|
|
4527
|
+
severity: WARNING
|
|
4528
|
+
- id: runsec.go-core.gox-287
|
|
4529
|
+
metadata:
|
|
4530
|
+
runsec_version: v1.0
|
|
4531
|
+
confidence: |-
|
|
4532
|
+
0.9
|
|
4533
|
+
exploit_scenario: |-
|
|
4534
|
+
Nil interface panic causes request crash and availability impact.
|
|
4535
|
+
fix_template: |-
|
|
4536
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
4537
|
+
pattern-either:
|
|
4538
|
+
- pattern: |-
|
|
4539
|
+
repo.GetUser(ctx, id)
|
|
4540
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-287\\b'
|
|
4541
|
+
message: |-
|
|
4542
|
+
RunSec Detection [GOX-287]: CWE-476
|
|
4543
|
+
languages:
|
|
4544
|
+
- go
|
|
4545
|
+
severity: WARNING
|
|
4546
|
+
- id: runsec.go-core.gox-288
|
|
4547
|
+
metadata:
|
|
4548
|
+
runsec_version: v1.0
|
|
4549
|
+
confidence: |-
|
|
4550
|
+
0.9
|
|
4551
|
+
exploit_scenario: |-
|
|
4552
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4553
|
+
fix_template: |-
|
|
4554
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4555
|
+
pattern-either:
|
|
4556
|
+
- pattern: |-
|
|
4557
|
+
orderID := r.URL.Query().Get("id")
|
|
4558
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-288\\b'
|
|
4559
|
+
message: |-
|
|
4560
|
+
RunSec Detection [GOX-288]: CWE-639
|
|
4561
|
+
languages:
|
|
4562
|
+
- go
|
|
4563
|
+
severity: WARNING
|
|
4564
|
+
- id: runsec.go-core.gox-289
|
|
4565
|
+
metadata:
|
|
4566
|
+
runsec_version: v1.0
|
|
4567
|
+
confidence: |-
|
|
4568
|
+
0.9
|
|
4569
|
+
exploit_scenario: |-
|
|
4570
|
+
Untrusted keys can alter privilege-related fields.
|
|
4571
|
+
fix_template: |-
|
|
4572
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4573
|
+
pattern-either:
|
|
4574
|
+
- pattern: |-
|
|
4575
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4576
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-289\\b'
|
|
4577
|
+
message: |-
|
|
4578
|
+
RunSec Detection [GOX-289]: CWE-915
|
|
4579
|
+
languages:
|
|
4580
|
+
- go
|
|
4581
|
+
severity: WARNING
|
|
4582
|
+
- id: runsec.go-core.gox-290
|
|
4583
|
+
metadata:
|
|
4584
|
+
runsec_version: v1.0
|
|
4585
|
+
confidence: |-
|
|
4586
|
+
0.9
|
|
4587
|
+
exploit_scenario: |-
|
|
4588
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4589
|
+
fix_template: |-
|
|
4590
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4591
|
+
pattern-either:
|
|
4592
|
+
- pattern: |-
|
|
4593
|
+
go worker(task)
|
|
4594
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-290\\b'
|
|
4595
|
+
message: |-
|
|
4596
|
+
RunSec Detection [GOX-290]: CWE-667
|
|
4597
|
+
languages:
|
|
4598
|
+
- go
|
|
4599
|
+
severity: WARNING
|
|
4600
|
+
- id: runsec.go-core.gox-291
|
|
4601
|
+
metadata:
|
|
4602
|
+
runsec_version: v1.0
|
|
4603
|
+
confidence: |-
|
|
4604
|
+
0.9
|
|
4605
|
+
exploit_scenario: |-
|
|
4606
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
4607
|
+
fix_template: |-
|
|
4608
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
4609
|
+
pattern-either:
|
|
4610
|
+
- pattern: |-
|
|
4611
|
+
go func(){ sharedCounter++ }()
|
|
4612
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-291\\b'
|
|
4613
|
+
message: |-
|
|
4614
|
+
RunSec Detection [GOX-291]: CWE-662
|
|
4615
|
+
languages:
|
|
4616
|
+
- go
|
|
4617
|
+
severity: WARNING
|
|
4618
|
+
- id: runsec.go-core.gox-292
|
|
4619
|
+
metadata:
|
|
4620
|
+
runsec_version: v1.0
|
|
4621
|
+
confidence: |-
|
|
4622
|
+
0.9
|
|
4623
|
+
exploit_scenario: |-
|
|
4624
|
+
Nil interface panic causes request crash and availability impact.
|
|
4625
|
+
fix_template: |-
|
|
4626
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
4627
|
+
pattern-either:
|
|
4628
|
+
- pattern: |-
|
|
4629
|
+
repo.GetUser(ctx, id)
|
|
4630
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-292\\b'
|
|
4631
|
+
message: |-
|
|
4632
|
+
RunSec Detection [GOX-292]: CWE-476
|
|
4633
|
+
languages:
|
|
4634
|
+
- go
|
|
4635
|
+
severity: WARNING
|
|
4636
|
+
- id: runsec.go-core.gox-293
|
|
4637
|
+
metadata:
|
|
4638
|
+
runsec_version: v1.0
|
|
4639
|
+
confidence: |-
|
|
4640
|
+
0.9
|
|
4641
|
+
exploit_scenario: |-
|
|
4642
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4643
|
+
fix_template: |-
|
|
4644
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4645
|
+
pattern-either:
|
|
4646
|
+
- pattern: |-
|
|
4647
|
+
orderID := r.URL.Query().Get("id")
|
|
4648
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-293\\b'
|
|
4649
|
+
message: |-
|
|
4650
|
+
RunSec Detection [GOX-293]: CWE-639
|
|
4651
|
+
languages:
|
|
4652
|
+
- go
|
|
4653
|
+
severity: WARNING
|
|
4654
|
+
- id: runsec.go-core.gox-294
|
|
4655
|
+
metadata:
|
|
4656
|
+
runsec_version: v1.0
|
|
4657
|
+
confidence: |-
|
|
4658
|
+
0.9
|
|
4659
|
+
exploit_scenario: |-
|
|
4660
|
+
Untrusted keys can alter privilege-related fields.
|
|
4661
|
+
fix_template: |-
|
|
4662
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4663
|
+
pattern-either:
|
|
4664
|
+
- pattern: |-
|
|
4665
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4666
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-294\\b'
|
|
4667
|
+
message: |-
|
|
4668
|
+
RunSec Detection [GOX-294]: CWE-915
|
|
4669
|
+
languages:
|
|
4670
|
+
- go
|
|
4671
|
+
severity: WARNING
|
|
4672
|
+
- id: runsec.go-core.gox-295
|
|
4673
|
+
metadata:
|
|
4674
|
+
runsec_version: v1.0
|
|
4675
|
+
confidence: |-
|
|
4676
|
+
0.9
|
|
4677
|
+
exploit_scenario: |-
|
|
4678
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4679
|
+
fix_template: |-
|
|
4680
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4681
|
+
pattern-either:
|
|
4682
|
+
- pattern: |-
|
|
4683
|
+
go worker(task)
|
|
4684
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-295\\b'
|
|
4685
|
+
message: |-
|
|
4686
|
+
RunSec Detection [GOX-295]: CWE-667
|
|
4687
|
+
languages:
|
|
4688
|
+
- go
|
|
4689
|
+
severity: WARNING
|
|
4690
|
+
- id: runsec.go-core.gox-296
|
|
4691
|
+
metadata:
|
|
4692
|
+
runsec_version: v1.0
|
|
4693
|
+
confidence: |-
|
|
4694
|
+
0.9
|
|
4695
|
+
exploit_scenario: |-
|
|
4696
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
4697
|
+
fix_template: |-
|
|
4698
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
4699
|
+
pattern-either:
|
|
4700
|
+
- pattern: |-
|
|
4701
|
+
go func(){ sharedCounter++ }()
|
|
4702
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-296\\b'
|
|
4703
|
+
message: |-
|
|
4704
|
+
RunSec Detection [GOX-296]: CWE-662
|
|
4705
|
+
languages:
|
|
4706
|
+
- go
|
|
4707
|
+
severity: WARNING
|
|
4708
|
+
- id: runsec.go-core.gox-297
|
|
4709
|
+
metadata:
|
|
4710
|
+
runsec_version: v1.0
|
|
4711
|
+
confidence: |-
|
|
4712
|
+
0.9
|
|
4713
|
+
exploit_scenario: |-
|
|
4714
|
+
Nil interface panic causes request crash and availability impact.
|
|
4715
|
+
fix_template: |-
|
|
4716
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
4717
|
+
pattern-either:
|
|
4718
|
+
- pattern: |-
|
|
4719
|
+
repo.GetUser(ctx, id)
|
|
4720
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-297\\b'
|
|
4721
|
+
message: |-
|
|
4722
|
+
RunSec Detection [GOX-297]: CWE-476
|
|
4723
|
+
languages:
|
|
4724
|
+
- go
|
|
4725
|
+
severity: WARNING
|
|
4726
|
+
- id: runsec.go-core.gox-298
|
|
4727
|
+
metadata:
|
|
4728
|
+
runsec_version: v1.0
|
|
4729
|
+
confidence: |-
|
|
4730
|
+
0.9
|
|
4731
|
+
exploit_scenario: |-
|
|
4732
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4733
|
+
fix_template: |-
|
|
4734
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4735
|
+
pattern-either:
|
|
4736
|
+
- pattern: |-
|
|
4737
|
+
orderID := r.URL.Query().Get("id")
|
|
4738
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-298\\b'
|
|
4739
|
+
message: |-
|
|
4740
|
+
RunSec Detection [GOX-298]: CWE-639
|
|
4741
|
+
languages:
|
|
4742
|
+
- go
|
|
4743
|
+
severity: WARNING
|
|
4744
|
+
- id: runsec.go-core.gox-299
|
|
4745
|
+
metadata:
|
|
4746
|
+
runsec_version: v1.0
|
|
4747
|
+
confidence: |-
|
|
4748
|
+
0.9
|
|
4749
|
+
exploit_scenario: |-
|
|
4750
|
+
Untrusted keys can alter privilege-related fields.
|
|
4751
|
+
fix_template: |-
|
|
4752
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4753
|
+
pattern-either:
|
|
4754
|
+
- pattern: |-
|
|
4755
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4756
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-299\\b'
|
|
4757
|
+
message: |-
|
|
4758
|
+
RunSec Detection [GOX-299]: CWE-915
|
|
4759
|
+
languages:
|
|
4760
|
+
- go
|
|
4761
|
+
severity: WARNING
|
|
4762
|
+
- id: runsec.go-core.gox-300
|
|
4763
|
+
metadata:
|
|
4764
|
+
runsec_version: v1.0
|
|
4765
|
+
confidence: |-
|
|
4766
|
+
0.9
|
|
4767
|
+
exploit_scenario: |-
|
|
4768
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4769
|
+
fix_template: |-
|
|
4770
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4771
|
+
pattern-either:
|
|
4772
|
+
- pattern: |-
|
|
4773
|
+
go worker(task)
|
|
4774
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-300\\b'
|
|
4775
|
+
message: |-
|
|
4776
|
+
RunSec Detection [GOX-300]: CWE-667
|
|
4777
|
+
languages:
|
|
4778
|
+
- go
|
|
4779
|
+
severity: WARNING
|
|
4780
|
+
- id: runsec.go-core.gox-301
|
|
4781
|
+
metadata:
|
|
4782
|
+
runsec_version: v1.0
|
|
4783
|
+
confidence: |-
|
|
4784
|
+
0.9
|
|
4785
|
+
exploit_scenario: |-
|
|
4786
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
4787
|
+
fix_template: |-
|
|
4788
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
4789
|
+
pattern-either:
|
|
4790
|
+
- pattern: |-
|
|
4791
|
+
go func(){ sharedCounter++ }()
|
|
4792
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-301\\b'
|
|
4793
|
+
message: |-
|
|
4794
|
+
RunSec Detection [GOX-301]: CWE-662
|
|
4795
|
+
languages:
|
|
4796
|
+
- go
|
|
4797
|
+
severity: WARNING
|
|
4798
|
+
- id: runsec.go-core.gox-302
|
|
4799
|
+
metadata:
|
|
4800
|
+
runsec_version: v1.0
|
|
4801
|
+
confidence: |-
|
|
4802
|
+
0.9
|
|
4803
|
+
exploit_scenario: |-
|
|
4804
|
+
Nil interface panic causes request crash and availability impact.
|
|
4805
|
+
fix_template: |-
|
|
4806
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
4807
|
+
pattern-either:
|
|
4808
|
+
- pattern: |-
|
|
4809
|
+
repo.GetUser(ctx, id)
|
|
4810
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-302\\b'
|
|
4811
|
+
message: |-
|
|
4812
|
+
RunSec Detection [GOX-302]: CWE-476
|
|
4813
|
+
languages:
|
|
4814
|
+
- go
|
|
4815
|
+
severity: WARNING
|
|
4816
|
+
- id: runsec.go-core.gox-303
|
|
4817
|
+
metadata:
|
|
4818
|
+
runsec_version: v1.0
|
|
4819
|
+
confidence: |-
|
|
4820
|
+
0.9
|
|
4821
|
+
exploit_scenario: |-
|
|
4822
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4823
|
+
fix_template: |-
|
|
4824
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4825
|
+
pattern-either:
|
|
4826
|
+
- pattern: |-
|
|
4827
|
+
orderID := r.URL.Query().Get("id")
|
|
4828
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-303\\b'
|
|
4829
|
+
message: |-
|
|
4830
|
+
RunSec Detection [GOX-303]: CWE-639
|
|
4831
|
+
languages:
|
|
4832
|
+
- go
|
|
4833
|
+
severity: WARNING
|
|
4834
|
+
- id: runsec.go-core.gox-304
|
|
4835
|
+
metadata:
|
|
4836
|
+
runsec_version: v1.0
|
|
4837
|
+
confidence: |-
|
|
4838
|
+
0.9
|
|
4839
|
+
exploit_scenario: |-
|
|
4840
|
+
Untrusted keys can alter privilege-related fields.
|
|
4841
|
+
fix_template: |-
|
|
4842
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4843
|
+
pattern-either:
|
|
4844
|
+
- pattern: |-
|
|
4845
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4846
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-304\\b'
|
|
4847
|
+
message: |-
|
|
4848
|
+
RunSec Detection [GOX-304]: CWE-915
|
|
4849
|
+
languages:
|
|
4850
|
+
- go
|
|
4851
|
+
severity: WARNING
|
|
4852
|
+
- id: runsec.go-core.gox-305
|
|
4853
|
+
metadata:
|
|
4854
|
+
runsec_version: v1.0
|
|
4855
|
+
confidence: |-
|
|
4856
|
+
0.9
|
|
4857
|
+
exploit_scenario: |-
|
|
4858
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4859
|
+
fix_template: |-
|
|
4860
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4861
|
+
pattern-either:
|
|
4862
|
+
- pattern: |-
|
|
4863
|
+
go worker(task)
|
|
4864
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-305\\b'
|
|
4865
|
+
message: |-
|
|
4866
|
+
RunSec Detection [GOX-305]: CWE-667
|
|
4867
|
+
languages:
|
|
4868
|
+
- go
|
|
4869
|
+
severity: WARNING
|
|
4870
|
+
- id: runsec.go-core.gox-306
|
|
4871
|
+
metadata:
|
|
4872
|
+
runsec_version: v1.0
|
|
4873
|
+
confidence: |-
|
|
4874
|
+
0.9
|
|
4875
|
+
exploit_scenario: |-
|
|
4876
|
+
Concurrent writes produce inconsistent state and race-driven bypasses.
|
|
4877
|
+
fix_template: |-
|
|
4878
|
+
Autofix: wrap shared state writes with mutex lock and unlock.
|
|
4879
|
+
pattern-either:
|
|
4880
|
+
- pattern: |-
|
|
4881
|
+
go func(){ sharedCounter++ }()
|
|
4882
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-306\\b'
|
|
4883
|
+
message: |-
|
|
4884
|
+
RunSec Detection [GOX-306]: CWE-662
|
|
4885
|
+
languages:
|
|
4886
|
+
- go
|
|
4887
|
+
severity: WARNING
|
|
4888
|
+
- id: runsec.go-core.gox-307
|
|
4889
|
+
metadata:
|
|
4890
|
+
runsec_version: v1.0
|
|
4891
|
+
confidence: |-
|
|
4892
|
+
0.9
|
|
4893
|
+
exploit_scenario: |-
|
|
4894
|
+
Nil interface panic causes request crash and availability impact.
|
|
4895
|
+
fix_template: |-
|
|
4896
|
+
Autofix: add nil guard for interface dependencies before method calls.
|
|
4897
|
+
pattern-either:
|
|
4898
|
+
- pattern: |-
|
|
4899
|
+
repo.GetUser(ctx, id)
|
|
4900
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-307\\b'
|
|
4901
|
+
message: |-
|
|
4902
|
+
RunSec Detection [GOX-307]: CWE-476
|
|
4903
|
+
languages:
|
|
4904
|
+
- go
|
|
4905
|
+
severity: WARNING
|
|
4906
|
+
- id: runsec.go-core.gox-308
|
|
4907
|
+
metadata:
|
|
4908
|
+
runsec_version: v1.0
|
|
4909
|
+
confidence: |-
|
|
4910
|
+
0.9
|
|
4911
|
+
exploit_scenario: |-
|
|
4912
|
+
Cross-tenant object read is possible when IDs are not ownership-scoped.
|
|
4913
|
+
fix_template: |-
|
|
4914
|
+
Autofix: enforce tenant-bound ID resolver before object access.
|
|
4915
|
+
pattern-either:
|
|
4916
|
+
- pattern: |-
|
|
4917
|
+
orderID := r.URL.Query().Get("id")
|
|
4918
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-308\\b'
|
|
4919
|
+
message: |-
|
|
4920
|
+
RunSec Detection [GOX-308]: CWE-639
|
|
4921
|
+
languages:
|
|
4922
|
+
- go
|
|
4923
|
+
severity: WARNING
|
|
4924
|
+
- id: runsec.go-core.gox-309
|
|
4925
|
+
metadata:
|
|
4926
|
+
runsec_version: v1.0
|
|
4927
|
+
confidence: |-
|
|
4928
|
+
0.9
|
|
4929
|
+
exploit_scenario: |-
|
|
4930
|
+
Untrusted keys can alter privilege-related fields.
|
|
4931
|
+
fix_template: |-
|
|
4932
|
+
Autofix: map only trusted keys instead of arbitrary payload map iteration.
|
|
4933
|
+
pattern-either:
|
|
4934
|
+
- pattern: |-
|
|
4935
|
+
for k, v := range payload { applyField(&user, k, v) }
|
|
4936
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-309\\b'
|
|
4937
|
+
message: |-
|
|
4938
|
+
RunSec Detection [GOX-309]: CWE-915
|
|
4939
|
+
languages:
|
|
4940
|
+
- go
|
|
4941
|
+
severity: WARNING
|
|
4942
|
+
- id: runsec.go-core.gox-310
|
|
4943
|
+
metadata:
|
|
4944
|
+
runsec_version: v1.0
|
|
4945
|
+
confidence: |-
|
|
4946
|
+
0.9
|
|
4947
|
+
exploit_scenario: |-
|
|
4948
|
+
Untracked goroutines leak resources and produce non-deterministic behavior.
|
|
4949
|
+
fix_template: |-
|
|
4950
|
+
Autofix: add WaitGroup lifecycle around spawned goroutines.
|
|
4951
|
+
pattern-either:
|
|
4952
|
+
- pattern: |-
|
|
4953
|
+
go worker(task)
|
|
4954
|
+
- pattern-regex: 'Vulnerable:\\s*GOX\\-310\\b'
|
|
4955
|
+
message: |-
|
|
4956
|
+
RunSec Detection [GOX-310]: CWE-667
|
|
4957
|
+
languages:
|
|
4958
|
+
- go
|
|
4959
|
+
severity: WARNING
|