Q
Detector Library
Go detectors (45/45)
Useless if BodyChannel Guarded With MutexImproper Certificate ValidationUnvalidated S3 Bucket OwnershipResource LeakInsecure CookieWeak Random Number GenerationRedundant Equality CheckInsecure Ignore Host KeyUnsafe ReflectionUnchecked Batch Operation FailuresLambda Client ReuseOs Command InjectionUseless if ConditionalLog InjectionHttptrace FileServer As HandlerPprof EndpointCross Site Scripting (XSS)Not Recommended API UsageHidden GoroutineChannel Accessible By Non EndpointDecompression BombCross-Site Request Forgery (CSRF)Thread Safety ViolationInsecure ConnectionSQL InjectionDeprecated Key GeneratorExported Loop PointerServer Side Request Forgery (SSRF)Sensitive Information LeakInteger OverflowMissing PaginationInsecure CryptographyProtection Mechanism FailureNil Pointer DereferenceTemporary FilesXML External EntityInsecure File PermissionsAuthentication Bypass By Alternate NameCode InjectionImproper authenticationUse Filepath JoinPath TraversalWrite Pprof Profile OutputHardcoded true or false
Server Side Request Forgery (SSRF) High
Using untrusted user input directly in HTTP client requests like http.Get and http.NewRequest can enable server-side request forgery (SSRF). Attackers may craft malicious input that alters request destinations to access unauthorized resources. All user data must be validated against an allowlist and sanitized before usage in constructing URLs, URIs or payloads. Failing to filter dangerous values enables SSRF by allowing request destinations to be controlled. Input validation provides the primary defense by restricting inputs to known safe values. This prevents malicious users from targeting unexpected systems through client requests.
Detector ID
go/server-side-request-forgery@v1.0
Category
Common Weakness Enumeration (CWE) 