Skip to content

Commit

Permalink
Merge pull request #21 from ro-tex/fix_typos
Browse files Browse the repository at this point in the history
Fix a couple of typos and remove an unused constant.
  • Loading branch information
ccojocar authored Nov 2, 2020
2 parents 8bed8a2 + 3f6afb5 commit b4b40a2
Show file tree
Hide file tree
Showing 4 changed files with 4 additions and 5 deletions.
2 changes: 1 addition & 1 deletion docs/rules/g104_unchecked_erros.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ id: g104
title: G104: Audit errors not checked
---

Really useful feature of Golang is the ability to return a tuple of a result and an error value from a function. There is an unspoken rule in Golang that the result of a function is unsafe until you make check the error value. Many security exploits can be performed when the error value is not checked.
A really useful feature of Golang is the ability to return a tuple of a result and an error value from a function. There is an unspoken rule in Golang that the result of a function is unsafe until you make check the error value. Many security exploits can be performed when the error value is not checked.

## Example code:

Expand Down
4 changes: 2 additions & 2 deletions docs/rules/g107_url_arg_to_http_request_as_taint_input.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,10 @@ id: g107
title: G107: Url provided to HTTP request as taint input
---

Getting an URL from an untrusted source like user input gives the ability of an attacker to redirect your application to bad websites and perform additional attacks.
Getting a URL from an untrusted source like user input gives the ability of an attacker to redirect your application to bad websites and perform additional attacks.
One of the examples is as shown below the [http.Get()](https://golang.org/pkg/net/http/#Client.Get) function issues a GET to the specified URL and if the result is appropriate GET will follow the redirect after calling Client's CheckRedirect function. That means that the attacker can send your application to various places.

This problem can be used to achieve [SSRF](https://www.acunetix.com/blog/articles/server-side-request-forgery-vulnerability/) atttacks via http requests with variable url.
This problem can be used to achieve [SSRF](https://www.acunetix.com/blog/articles/server-side-request-forgery-vulnerability/) attacks via http requests with variable url.

## Example problematic code:

Expand Down
2 changes: 1 addition & 1 deletion docs/rules/g304_file-path_provided_as_taint_input.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ id: g304
title: G304: File path provided as taint input
---

Trying to open a file provided as an input in a variable. The content of this variable might be controlled by an attacker who could change it to hold unauthorised file paths form the system. In this way, it is possible to exfiltrate confidential information or such.
Trying to open a file provided as an input in a variable. The content of this variable might be controlled by an attacker who could change it to hold unauthorised file paths from the system. In this way, it is possible to exfiltrate confidential information or such.

## Example problematic code:

Expand Down
1 change: 0 additions & 1 deletion website/core/Footer.js
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ class Footer extends React.Component {
}

render() {
const currentYear = new Date().getFullYear();
return (
<footer className="nav-footer" id="footer">
<section className="sitemap">
Expand Down

0 comments on commit b4b40a2

Please sign in to comment.