Description

Detects usage of unencrypted FTP connections through the jlaffaye/ftp Go package. Using FTP without encryption can expose sensitive data and credentials in plaintext during transmission, making them vulnerable to interception.

Detection Strategy

• Check if the code imports the 'github.com/jlaffaye/ftp' package

• Look for function calls or method invocations using this FTP package

• Report vulnerability when FTP connections are established without encryption configuration

Vulnerable code example

package main

import (
    "github.com/jlaffaye/ftp"
    "time"
)

func main() {...

✅ Secure code example

package main

import (
    "crypto/tls"
    "log"
    "github.com/jlaffaye/ftp"
)
...