Description

Detects potential path traversal vulnerabilities in Go code where file permission modification operations (chmod) accept unsanitized user input. This could allow attackers to modify permissions of unauthorized files by manipulating path parameters with directory traversal sequences.

Detection Strategy

• Identifies import statements that include the 'os' package which provides filesystem operations

• Locates calls to the os.Chmod() function in the code

• Checks if the chmod operation's path parameter contains or is derived from user input without proper sanitization

• Reports a vulnerability if user-controlled data can influence the target path of the chmod operation

Vulnerable code example

package main

import (
    "os"
    "net/http"
)

func handler(w http.ResponseWriter, r *http.Request) {...

✅ Secure code example

package main

import (
    "net/http"
    "os"
    "path/filepath"
    "strings"
)...