Net
unescaped-data-in-htmlattr
unescaped-data-in-htmlattr
Found a formatted template string passed to ‘template. HTMLAttr()’. ‘template.HTMLAttr()’ does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
formatted-template-string
formatted-template-string
Found a formatted template string passed to ‘template.HTML()’. ‘template.HTML()’ does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability.
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
avoid-bind-to-all-interfaces
avoid-bind-to-all-interfaces
Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string.
Likelihood: LOW
Confidence: HIGH
CWE:
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
OWASP:
- A01:2021 - Broken Access Control
wip-xss-using-responsewriter-and-printf
wip-xss-using-responsewriter-and-printf
Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped.
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
cookie-missing-httponly
cookie-missing-httponly
cookie-missing-secure
cookie-missing-secure
unescaped-data-in-url
unescaped-data-in-url
Found a formatted template string passed to ‘template.URL()’. ‘template.URL()’ does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
pprof-debug-exposure
pprof-debug-exposure
The profiling ‘pprof’ endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use import "net/http/pprof"
. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-489: Active Debug Code
OWASP:
- A
- 0
- 6
- :
- 2
- 0
- 1
- 7
-
- -
-
- S
- e
- c
- u
- r
- i
- t
- y
-
- M
- i
- s
- c
- o
- n
- f
- i
- g
- u
- r
- a
- t
- i
- o
- n
use-tls
use-tls
Found an HTTP server without TLS. Use ‘http.ListenAndServeTLS’ instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-319: Cleartext Transmission of Sensitive Information
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
fs-directory-listing
fs-directory-listing
Detected usage of ‘http.FileServer’ as handler: this allows directory listing and an attacker could navigate through directories looking for sensitive files. Be sure to disable directory listing or restrict access to specific directories/files.
Likelihood: MEDIUM
Confidence: MEDIUM
CWE:
- CWE-548: Exposure of Information Through Directory Listing
OWASP:
- A06:2017 - Security Misconfiguration
- A01:2021 - Broken Access Control
dynamic-httptrace-clienttrace
dynamic-httptrace-clienttrace
Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for ‘$TRACE’. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined.
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-913: Improper Control of Dynamically-Managed Code Resources
OWASP:
- A01:2021 - Broken Access Control
unescaped-data-in-js
unescaped-data-in-js
Found a formatted template string passed to ‘template.JS()’. ‘template.JS()’ does not escape contents. Be absolutely sure there is no user-controlled data in this template.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection