secure-dev-golang

These rules apply to all Go code in the repository (CLI tools, services, handlers, background jobs) and aim to prevent common security risks through disciplined input handling, safe APIs, and secure defaults.

All violations must include a clear explanation of which rule was triggered and why, so developers can fix issues quickly.
Generated code must not violate these rules. If a rule is violated, add a code comment that explains the problem and proposes a correction.

1. Decode Untrusted Data Safely

• Rule: Do not deserialize untrusted data with unsafe or permissive decoders. Prefer strict JSON or protobuf with size limits. Reject unknown fields. Avoid encoding/gob for untrusted input. Use strict YAML decoding only if required.
• Unsafe:

  // Accepts arbitrarily large input and unknown fields
  var in any
  _ = json.NewDecoder(r.Body).Decode(&in)
  

• Safe:

  type CreateUser struct {
      Name  string `json:"name"`
      Email string `json:"email"`
  }
  
  dec := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)) // 1 MB cap
  dec.DisallowUnknownFields()
  dec.UseNumber()
  
  var in CreateUser
  if err := dec.Decode(&in); err != nil { /* handle */ }
  

• YAML (only if needed):

  dec := yaml.NewDecoder(bytes.NewReader(b))
  dec.KnownFields(true) // yaml.v3
  if err := dec.Decode(&cfg); err != nil { /* handle */ }
  

• Protobuf JSON:

  opts := protojson.UnmarshalOptions{DiscardUnknown: false}
  if err := opts.Unmarshal(b, msg); err != nil { /* handle */ }
  

2. Use Parameterized Queries for Database Access

• Rule: Never format SQL with user input. Use placeholders and arguments. Use context with timeouts.
• Unsafe:

  query := fmt.Sprintf("SELECT * FROM users WHERE name = '%s'", name)
  rows, _ := db.Query(query)
  

• Safe:

  ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
  defer cancel()
  
  row := db.QueryRowContext(ctx, "SELECT id FROM users WHERE name = $1", name)