Backend Development
Golang
About the gosec G drama, or how I faced back integer conversion overflow in Go
About the gosec G drama, or how I faced back integer conversion overflow in Go
Go is a strongly typed language, it avoids making mistakes.
I wrongly assumed Go was handling integer overflows, and reported an error.
Here is the perfect world where everything works as expected
a := int64(42) b := uint8(a) fmt.Println(b) // 42
So what does the following code
a = 255 + 1 // 255 is the higher value an uint8 can reach b = uint8(a) fmt.Println(b) // ? a = -1 b = uint8(a) fmt.Println(b) // ?
Here is the solution
Spoiler: it doesn't work as expected, or at least as we could expect.
So here Go is doing a silent conversion, of course it cannot store the value in the integer types provided, but there is no error at all.
There are consequences: CWE-190
- Imagine you access a resource by its identifier, but you need to convert from an integer type to another, you may allow to access to another resource.
Because of this, gosec a linter focused on improving the security in Go, provided a linter to detect the issue: the linter G115
The G115 linter idea was good.
But it was unfortunately merged with some false issues, that are now addressed, except a few ones.
The problem becomes massive after gosec v2.21.0 was merged into golangci-lint
Many people disabled gosec G115, because of the false positives and noise it was bringing to the CI
So now many people unfortunately disabled the G115 checker, you can see it easily on GitHub
The above is the detailed content of About the gosec G drama, or how I faced back integer conversion overflow in Go. For more information, please follow other related articles on the PHP Chinese website!
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
AI Hentai Generator
Generate AI Hentai for free.
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
1384
52
What are the vulnerabilities of Debian OpenSSL
Apr 02, 2025 am 07:30 AM
OpenSSL, as an open source library widely used in secure communications, provides encryption algorithms, keys and certificate management functions. However, there are some known security vulnerabilities in its historical version, some of which are extremely harmful. This article will focus on common vulnerabilities and response measures for OpenSSL in Debian systems. DebianOpenSSL known vulnerabilities: OpenSSL has experienced several serious vulnerabilities, such as: Heart Bleeding Vulnerability (CVE-2014-0160): This vulnerability affects OpenSSL 1.0.1 to 1.0.1f and 1.0.2 to 1.0.2 beta versions. An attacker can use this vulnerability to unauthorized read sensitive information on the server, including encryption keys, etc.
How do you use the pprof tool to analyze Go performance?
Mar 21, 2025 pm 06:37 PM
The article explains how to use the pprof tool for analyzing Go performance, including enabling profiling, collecting data, and identifying common bottlenecks like CPU and memory issues.Character count: 159
How do you write unit tests in Go?
Mar 21, 2025 pm 06:34 PM
The article discusses writing unit tests in Go, covering best practices, mocking techniques, and tools for efficient test management.
What is the problem with Queue thread in Go's crawler Colly?
Apr 02, 2025 pm 02:09 PM
Queue threading problem in Go crawler Colly explores the problem of using the Colly crawler library in Go language, developers often encounter problems with threads and request queues. �...
What libraries are used for floating point number operations in Go?
Apr 02, 2025 pm 02:06 PM
The library used for floating-point number operation in Go language introduces how to ensure the accuracy is...
What is the go fmt command and why is it important?
Mar 20, 2025 pm 04:21 PM
The article discusses the go fmt command in Go programming, which formats code to adhere to official style guidelines. It highlights the importance of go fmt for maintaining code consistency, readability, and reducing style debates. Best practices fo
PostgreSQL monitoring method under Debian
Apr 02, 2025 am 07:27 AM
This article introduces a variety of methods and tools to monitor PostgreSQL databases under the Debian system, helping you to fully grasp database performance monitoring. 1. Use PostgreSQL to build-in monitoring view PostgreSQL itself provides multiple views for monitoring database activities: pg_stat_activity: displays database activities in real time, including connections, queries, transactions and other information. pg_stat_replication: Monitors replication status, especially suitable for stream replication clusters. pg_stat_database: Provides database statistics, such as database size, transaction commit/rollback times and other key indicators. 2. Use log analysis tool pgBadg
Transforming from front-end to back-end development, is it more promising to learn Java or Golang?
Apr 02, 2025 am 09:12 AM
Backend learning path: The exploration journey from front-end to back-end As a back-end beginner who transforms from front-end development, you already have the foundation of nodejs,...
