fix(go): treat integer conversion as a taint sanitizer (fewer FPs) - #250
Merged
Merged
Conversation
Second precision pass over AWS deception-bench. A user parameter converted to a number via strconv (Atoi/ParseInt/ParseUint/ParseFloat/ParseBool) can no longer carry a `../`, a shell metacharacter, or a URL host — so a path/URL/command built from it is safe. The Go taint rules now sanitize on those conversions. - Added strconv.* as pattern-sanitizers to the request-source Go taint rules (command-injection, ssrf, path-traversal, open-redirect). Sound and language-level, NOT app-specific — so no overfitting to the benchmark. - A string parameter straight into a sink still flags (true positives kept). Deliberately NOT changed: the remaining ~24 deception-bench Go candidates (open-redirect/path/ssrf) are "safe" only via app-specific validators (validateRedirectHost, sanitizeFilename, validateUpstreamHost, confinement checks), and the benchmark pairs each with a vulnerable variant where that validation is subtly broken (e.g. validate the normalized URL, redirect the original). Recognizing those validators by name would overfit AND suppress the genuinely-vulnerable variants — so they are left to flag-with-review, the defensible SAST behavior. Verified — no regression on any language: - SAST-injection fixture gate per language: TS/JS 12/12, Python 15/15, Java 10/10, Kotlin 9/9, Go 7/7 — all 0 FP (total 53/53, 0 FP). Only injection-go.yaml (all rules `languages: [go]`) + a Go fixture changed; other packs untouched. - int-converted param no longer flagged; string param still flagged. - govwa go-sast still 4/4. Full suite: 2621 passed. - Mined the int-conversion case into safe/ as a permanent regression guard. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EZ4QoTqRoYWE25CNoV2Wfy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Second precision pass over AWS deception-bench. A user parameter converted to a number via
strconv(Atoi/ParseInt/ParseUint/ParseFloat/ParseBool) can't carry../, a shell metachar, or a URL host — so a path/URL/command built from it is safe. The Go taint rules now sanitize on those conversions.strconv.*aspattern-sanitizersto the request-source Go taint rules (command-injection, ssrf, path-traversal, open-redirect). Sound and language-level, not app-specific — no overfitting.Deliberately NOT changed (the "do not overfit" call)
The remaining ~24 deception-bench Go candidates are "safe" only via app-specific validators (
validateRedirectHost,sanitizeFilename,validateUpstreamHost, confinement checks), and the benchmark pairs each with a vulnerable variant where that validation is subtly broken (e.g. validate the normalized URL, redirect the original). Recognizing those by name would overfit and suppress the genuinely-vulnerable variants, so they're left to flag-with-review.Verified — no regression on any language
Per-language fixture-gate recall / FPs: TS/JS 12/12, Python 15/15, Java 10/10, Kotlin 9/9, Go 7/7 — all 0 FP (total 53/53, 0 FP). Only
injection-go.yaml(every rulelanguages: [go]) + one Go fixture changed; other packs untouched. int-converted param no longer flagged, string param still flagged. govwa go-sast still 4/4. Full suite 2621 passed. Regression-guard fixture added.🤖 Generated with Claude Code
https://claude.ai/code/session_01EZ4QoTqRoYWE25CNoV2Wfy