sc-lang-go

SC: Go Security Deep Scan

Purpose

Detects Go-specific security anti-patterns, common mistakes, and language-idiomatic attack vectors that generic vulnerability skills cannot catch.

Activation

Activates when Go is detected in architecture.md.

Checklist Reference

References references/go-security-checklist.md.

Go-Specific Vulnerability Patterns

---

1. Unsafe Package Usage and Reflect Abuse

Pattern: Direct use of unsafe.Pointer to bypass Go type system, or reflect to access unexported fields, disabling memory safety guarantees.

Dangerous functions/patterns:

• unsafe.Pointer, unsafe.Sizeof, unsafe.Offsetof, unsafe.Alignof
• reflect.NewAt, reflect.Value.Pointer(), reflect.Value.UnsafeAddr()
• Casting unsafe.Pointer to uintptr and back (pointer arithmetic)
• Using //go:linkname to access internal runtime symbols

Safe alternative: Use type-safe interfaces, generics (Go 1.18+), and exported APIs. If unsafe is unavoidable, isolate it in a single package with extensive tests and document the invariants.

Vulnerable code:

func readPrivateField(s interface{}) string {
    v := reflect.ValueOf(s).Elem()
    f := v.FieldByName("secret")
    // Bypass unexported field protection via unsafe
    ptr := unsafe.Pointer(f.UnsafeAddr())
    return *(*string)(ptr)
}

Safe code:

// Export the field or provide an accessor method
type Config struct {
    Secret string // exported, or use a getter
}

func (c *Config) GetSecret() string {
    return c.Secret
}

---

2. CGo Boundary Safety

Pattern: Passing Go-managed memory across the CGo boundary without ensuring it remains valid, or accepting unsanitized C strings that may not be null-terminated.

Dangerous functions/patterns:

• C.CString() without corresponding C.free()
• Passing Go pointers to C functions that store them (violates CGo pointer rules)
• C.GoString() on untrusted C memory without length bounds
• C.GoBytes() with attacker-controlled length parameter