Use of unsafe calls should be audited
93 } else {
94 s = append(s, []string{k, strconv.FormatUint(uint64(id), 10), "0"})
95 }
96 if len(s)*int(unsafe.Sizeof("")) > 4e+6 { 97 if err = w.WriteAll(s); err != nil {
98 log.Fatal(err)
99 }
Description
Package unsafe contains operations that step around the type safety of Go
programs and may be non-portable. Also note that unsafe package is not
supported by Go 1 compatibility guidelines.
Using the unsafe package in Go gives you low-level memory management and many C language
strengths but provides flexibility to your attacker's application. The pointer arithmetic
is one example of an unsafe package used for the data leak, memory corruption, or even
execution of the attacker's script. Also, it would be best to remember that Go 1 compatibility
guidelines do not protect the "unsafe" package.
Bad practice
package main
import (
"fmt"
"unsafe"
)
type Fake struct{}
func (Fake) Good() {}
func main() {
unsafeM := Fake{}
unsafeM.Good()
intArray := [...]int{1, 2}
fmt.Printf("
intArray: %v
", intArray)
intPtr := &intArray[0]
fmt.Printf("
intPtr=%p, *intPtr=%d.
", intPtr, *intPtr)
addressHolder := uintptr(unsafe.Pointer(intPtr)) + unsafe.Sizeof(intArray[0])
intPtr = (*int)(unsafe.Pointer(addressHolder))
fmt.Printf("
intPtr=%p, *intPtr=%d.
", intPtr, *intPtr)
}