Go Security Cheatsheet Go Security Cheatsheet

ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
cmd := exec.CommandContext(ctx, "kubectl", "get", "pods", "-o", "json")
out, err := cmd.Output()                 // stdout only; stderr in ExitError
var ee *exec.ExitError
if errors.As(err, &ee) {
    log.Printf("exit %d: %s", ee.ExitCode(), ee.Stderr)
}

import crand "crypto/rand"

b := make([]byte, 32)
if _, err := crand.Read(b); err != nil {   // never ignore this error
    return err
}
token := base64.RawURLEncoding.EncodeToString(b)

n, err := crand.Int(crand.Reader, big.NewInt(100))   // unbiased 0..99

subtle.ConstantTimeCompare(got, want) == 1   // not bytes.Equal, for secrets

// NO: the value becomes part of the statement
db.Query("SELECT * FROM pods WHERE name = '" + name + "'")
db.Query(fmt.Sprintf("SELECT * FROM pods WHERE name = '%s'", name))

// YES: a bound parameter, sent separately from the SQL
db.QueryContext(ctx, "SELECT * FROM pods WHERE name = $1", name)   // postgres
db.QueryContext(ctx, "SELECT * FROM pods WHERE name = ?", name)    // mysql

rows, err := db.QueryContext(ctx, q, name)
if err != nil { return err }
defer rows.Close()                 // leaks a connection without this
for rows.Next() { ... }
return rows.Err()                  // the error you forget to check

if !filepath.IsLocal(userPath) {        // 1.20+: rejects .. and absolute paths
    return errors.New("path escapes the base directory")
}
f, err := os.Open(filepath.Join(base, userPath))

root, err := os.OpenRoot(base)          // 1.24+: the whole problem, solved
f, err := root.Open(userPath)           // cannot escape, even via a symlink

// NO: accepts any certificate, from anyone on the path
tr := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}

// YES: trust a private CA explicitly
pool := x509.NewCertPool()
pem, _ := os.ReadFile("/etc/ssl/corp-ca.pem")
pool.AppendCertsFromPEM(pem)
tr := &http.Transport{TLSClientConfig: &tls.Config{
    RootCAs:    pool,
    MinVersion: tls.VersionTLS12,        // the zero value allows older
}}

c := &http.Client{Timeout: 10 * time.Second}

req, _ := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
resp, err := c.Do(req)
if err != nil { return err }
defer resp.Body.Close()                       // always, or you leak the conn
io.Copy(io.Discard, io.LimitReader(resp.Body, 1<<20))  // cap what you read

srv := &http.Server{
    Addr:              ":8080",
    ReadHeaderTimeout: 5 * time.Second,     // slowloris
    ReadTimeout:       15 * time.Second,
    WriteTimeout:      30 * time.Second,
    IdleTimeout:       60 * time.Second,
}

token, ok := os.LookupEnv("API_TOKEN")
if !ok { return errors.New("API_TOKEN not set") }   // fail loudly, at startup

// Keep a secret out of a %v on a struct
type Config struct {
    Host  string
    Token Secret
}
type Secret string
func (Secret) String() string { return "[REDACTED]" }   // fmt uses this

go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...        # CVEs, filtered to functions you actually call

go list -m all           # the full module graph
go mod verify            # checksums match go.sum
go mod tidy -diff        # fails if tidy would change anything (recent Go)