* Port G120 from SSA-based to taint analysis
Fix#1600: G120 now detects ParseMultipartForm across function boundaries
using the taint engine's interprocedural call graph analysis.
Fix#1603: Remove ParseForm, FormValue, and PostFormValue from G120 sinks.
These methods already enforce a built-in 10 MiB body limit in Go's
standard library, so flagging them was a false positive. Only
ParseMultipartForm (genuinely unbounded without MaxBytesReader) is now
flagged.
Changes:
- Replace the 521-line custom SSA analyzer in form_parsing_limits.go with
a ~55-line taint analysis configuration.
- Extract the shared dependencyChecker (used by G119, G121, G122) into
its own file dependency_checker.go.
- Add FormParsingLimitRule (CWE-400) to the taint rule registry.
- Rewrite test samples to cover the new behavior including interprocedural
detection and the built-in limit exclusions.
* Update the RULES.md to be consistent with the implementation
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
---------
Signed-off-by: Cosmin Cojocar <cosmin@cojocar.ch>
* fix(G118): eliminate false positive for package-level cancel variables
G118 was incorrectly reporting context cancellation function not called
when the cancel function was assigned to a package-level variable (e.g.,
in init()) and called in a separate function (e.g., signal handler).
Root cause: isCancelCalled() lacked special handling for *ssa.Global
(package-level variables), causing cross-function tracking to fail.
Solution: Add dedicated tracking for package-level globals, similar to
the struct field handling added in PR #1596. The fix includes:
- Check in *ssa.Store case to detect global variable assignments
- isGlobalCalledInAnyFunc() helper to search all functions for calls
- isValueCalled() generalized helper for BFS value tracking
* additional test
Add taint analysis rule G709 to detect unsafe deserialization when
untrusted input flows into encoding/gob, encoding/xml, or
gopkg.in/yaml.v2 deserialization functions.
CWE-502. Includes 5 test samples (3 positive, 2 negative).
Add taint analysis rule G708 to detect SSTI vulnerabilities when using
Go text/template package. Covers two attack vectors:
- User input flowing into Template.Parse() (SSTI/RCE)
- Tainted data passed to Execute/ExecuteTemplate with http.ResponseWriter (XSS)
CWE-94. Includes 6 test samples (3 positive, 3 negative).
* fix(G118): eliminate false positive when cancel stored in struct field post-construction
When a cancel function is assigned to a struct field after construction
(e.g. s.cancel = cancel), the SSA FieldAddr for the store is a distinct
value from any FieldAddr created later for defer s.cancel() or inside a
closure. The existing isCancelCalledViaStructField only matched receiver
methods and missed these patterns.
Add isFieldCalledInAnyFunc which scans all SSA functions (including
closures) for a FieldAddr with matching struct pointer type and field
index, then checks whether the loaded value is called. As a side effect,
this also resolves the known false positive for nested struct field access.
fixes: 1595
* update rules documentation
Ravi Sastry Kadali
Cosmin Cojocar
dannyc-grafana