Go Security

// placeholders, matched to the driver
func findUser(db *sql.DB, name string) (*User, error) {
    return scanUser(db.QueryRow(
        "SELECT id, email FROM users WHERE name = ?", name,
    ))
}

// PostgreSQL (lib/pq, pgx stdlib): numbered placeholders
db.QueryRow("SELECT id FROM users WHERE email = $1", email)

// identifiers: map to a known set rather than concatenating
allowed := map[string]bool{"orders": true, "refunds": true}
if !allowed[tableName] {
    return nil, ErrInvalidTable
}
db.Query("SELECT * FROM " + tableName + " WHERE id = ?", id)

// fixed binary, argument vector, no shell
cmd := exec.CommandContext(ctx, "convert", userFile, "out.png")

// a pipeline without a shell: two commands, one pipe
first := exec.CommandContext(ctx, "gzip", "-dc", userFile)
second := exec.CommandContext(ctx, "tar", "-xf", "-")
pipe, _ := first.StdoutPipe()
second.Stdin = pipe
first.Start()
second.Run()

// user-selected tool: allowlist before exec, never the request value itself
tool, ok := approvedTools[req.FormValue("tool")]
if !ok {
    return fmt.Errorf("unknown tool")
}
exec.CommandContext(ctx, tool, "--version").Run()

// markup must come from html/template
t := template.Must(template.New("page").ParseFiles("templates/page.html"))
t.Execute(w, data) // contextual escaping, per action

// user content stays a string; only trusted, pre-rendered markup is typed
type TrustedHTML = template.HTML // assign only from a sanitiser's output

// user-supplied templates are not templates: treat them as data
t.Execute(w, map[string]string{"body": req.FormValue("body")})

// outside HTML (email, config, YAML) text/template is correct -
// escaping HTML into a mail body is its own bug

// anything an attacker must not predict comes from crypto/rand
func resetCode() (string, error) {
    b := make([]byte, 16)
    if _, err := rand.Read(b); err != nil { // crypto/rand
        return "", err
    }
    return base64.RawURLEncoding.EncodeToString(b), nil
}

// comparison of secrets uses constant time
if subtle.ConstantTimeCompare([]byte(got), []byte(want)) != 1 {
    return ErrInvalidCode
}

// math/rand remains correct for jitter, sampling and test data

// the check happens at dial time, on the resolved address
dialer := &net.Dialer{
    Control: func(network, address string, _ syscall.RawConn) error {
        host, _, _ := net.SplitHostPort(address)
        ip := net.ParseIP(host)
        if ip == nil || ip.IsLoopback() || ip.IsPrivate() ||
            ip.IsLinkLocalUnicast() || ip.IsUnspecified() {
            return fmt.Errorf("blocked address %s", host)
        }
        return nil
    },
}

client := &http.Client{
    Transport: &http.Transport{DialContext: dialer.DialContext},
    CheckRedirect: func(req *http.Request, via []*http.Request) error {
        if len(via) >= 3 {
            return errors.New("too many redirects")
        }
        return nil
    },
}

// allowlist the host if the feature has a known set of targets,
// and keep redirects from leaving it

// verification on, and the system roots are the trust decision
tr := &http.Transport{
    TLSClientConfig: &tls.Config{
        MinVersion: tls.VersionTLS12,
    },
}

// if an internal CA is the reason someone disabled verification,
// pin that CA instead - this is the actual fix
pool := x509.NewCertPool()
pool.AppendCertsFromPEM(internalCA)
tr.TLSClientConfig.RootCAs = pool

// server side: TLS 1.2 minimum, no version or cipher pinning
srv := &http.Server{
    TLSConfig: &tls.Config{MinVersion: tls.VersionTLS12},
}