Q
Detector Library
Go detectors (45/45)
Useless if BodyChannel Guarded With MutexImproper Certificate ValidationUnvalidated S3 Bucket OwnershipResource LeakInsecure CookieWeak Random Number GenerationRedundant Equality CheckInsecure Ignore Host KeyUnsafe ReflectionUnchecked Batch Operation FailuresLambda Client ReuseOs Command InjectionUseless if ConditionalLog InjectionHttptrace FileServer As HandlerPprof EndpointCross Site Scripting (XSS)Not Recommended API UsageHidden GoroutineChannel Accessible By Non EndpointDecompression BombCross-Site Request Forgery (CSRF)Thread Safety ViolationInsecure ConnectionSQL InjectionDeprecated Key GeneratorExported Loop PointerServer Side Request Forgery (SSRF)Sensitive Information LeakInteger OverflowMissing PaginationInsecure CryptographyProtection Mechanism FailureNil Pointer DereferenceTemporary FilesXML External EntityInsecure File PermissionsAuthentication Bypass By Alternate NameCode InjectionImproper authenticationUse Filepath JoinPath TraversalWrite Pprof Profile OutputHardcoded true or false
Httptrace FileServer As Handler High
Method http.FileServer should not be used as handler. This can lead to directory listing and grant malicious actors the ability to explore directories in search of confidential files. If directory listing is needed, it is imperative to implement access controls to safeguard specific directories and files to improve security.
Detector ID
go/http-trace-file-server-as-handler@v1.0
Category
Common Weakness Enumeration (CWE) 
Tags