go-security

Go Security

Secure coding patterns for production Go. Covers OWASP top risks as they apply to Go.

SQL Injection Prevention

Always use parameterized queries. Never interpolate user input into SQL strings.

// Wrong: SQL injection
query := "SELECT * FROM users WHERE id = '" + id + "'"
db.Query(query)

// Correct: parameterized query
db.QueryContext(ctx, "SELECT * FROM users WHERE id = $1", id)

This applies to all database drivers. The placeholder syntax varies ($1 for postgres, ? for mysql).

Path Traversal Prevention

os.Root (Go 1.24+)

Use os.Root for scoped file access. Paths are resolved within the root directory and cannot escape it.

root, err := os.OpenRoot("/var/data/uploads")
if err != nil {
    return err
}
defer root.Close()

// Safe: "../etc/passwd" is rejected
f, err := root.Open(userProvidedFilename)
if err != nil {
    return err
}
defer f.Close()

Pre-Go 1.24

Use filepath.Clean and verify the result stays within the intended directory:

cleaned := filepath.Clean(userInput)
absPath := filepath.Join(baseDir, cleaned)

// Verify the path is still under baseDir
if !strings.HasPrefix(absPath, filepath.Clean(baseDir)+string(os.PathSeparator)) {
    return fmt.Errorf("path traversal: %s", userInput)
}

Input Validation

Validate all external input at system boundaries. Internal code can trust validated data.

func parseUserID(raw string) (int64, error) {
    id, err := strconv.ParseInt(raw, 10, 64)
    if err != nil {
        return 0, fmt.Errorf("invalid user ID %q: %w", raw, err)
    }
    if id <= 0 {
        return 0, fmt.Errorf("user ID must be positive, got %d", id)
    }
    return id, nil
}

For structured input, decode into typed structs and validate fields:

var req CreateUserRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
    http.Error(w, "invalid request body", http.StatusBadRequest)
    return
}
if err := req.Validate(); err != nil {
    http.Error(w, err.Error(), http.StatusBadRequest)
    return
}