Description

Detects potential path traversal vulnerabilities in Go applications where untrusted user input can influence file system write operations. This could allow attackers to write files to unauthorized locations outside the intended directory structure, potentially leading to security breaches or system compromise.

Detection Strategy

• Check if the 'os' package is imported in the Go source code

• Look for file operations like os.Rename() that could modify the file system

• Analyze if the file path parameter contains or is influenced by user input

• Report a vulnerability if user-controlled data can affect the destination path of file operations

Vulnerable code example

package main

import (
    "net/http"
    "os"
)

func handleFileWrite(w http.ResponseWriter, r *http.Request) {...

✅ Secure code example

package main

import (
    "net/http"
    "os"
    "path/filepath"
    "strings"
)...