Description

Detects unsafe use of Go's reflection functionality in HTTP handlers that could allow attackers to access or modify arbitrary memory locations. This vulnerability can lead to information disclosure, memory corruption, or remote code execution.

Detection Strategy

• Verifies that both 'net/http' and 'reflect' packages are imported in the Go source file

• Identifies reflection-related function calls or operations that match known dangerous patterns

• Checks if the reflection operation is used in an HTTP handler context

• Confirms the reflection usage is not properly restricted or validated before execution

• Reports a vulnerability when unsafe reflection operations are directly influenced by HTTP request data

Vulnerable code example

package main

import (
    "net/http"
    "reflect"
)

type UserService struct{}...

✅ Secure code example

package main

import (
    "net/http"
    "reflect"
)

type UserService struct{}...