Q
Detector Library
Go detectors (45/45)
Useless if BodyChannel Guarded With MutexImproper Certificate ValidationUnvalidated S3 Bucket OwnershipResource LeakInsecure CookieWeak Random Number GenerationRedundant Equality CheckInsecure Ignore Host KeyUnsafe ReflectionUnchecked Batch Operation FailuresLambda Client ReuseOs Command InjectionUseless if ConditionalLog InjectionHttptrace FileServer As HandlerPprof EndpointCross Site Scripting (XSS)Not Recommended API UsageHidden GoroutineChannel Accessible By Non EndpointDecompression BombCross-Site Request Forgery (CSRF)Thread Safety ViolationInsecure ConnectionSQL InjectionDeprecated Key GeneratorExported Loop PointerServer Side Request Forgery (SSRF)Sensitive Information LeakInteger OverflowMissing PaginationInsecure CryptographyProtection Mechanism FailureNil Pointer DereferenceTemporary FilesXML External EntityInsecure File PermissionsAuthentication Bypass By Alternate NameCode InjectionImproper authenticationUse Filepath JoinPath TraversalWrite Pprof Profile OutputHardcoded true or false
Temporary Files High
Creating temporary files in shared /tmp or /var/tmp directories without using os.CreateTemp() can be insecure. An attacker may create symlinks to target sensitive files before the app writes the temp file. This can lead to overwriting or exposing unintended files. os.CreateTemp() sets permissions to prevent symlink attacks. Using it instead of directly writing temp files prevents unintended overwrites from malicious symlinks.
Detector ID
go/temporary-files@v1.0
Category
