Go for DevOps
You're viewing a free preview. Sign in free to read every script.
Why this exists Go removes whole classes of memory safety bugs, and leaves the logic bugs exactly where they are: trusting a file name, gluing text into a command or a query, comparing secrets carelessly, fetching a URL…
Secure Go Services: Path Traversal (os.Root), Command and Template Injection, Secrets, SSRF and govulncheck
The mistakes behind real incidents in Go tools, each shown as a working attack and a working fix: reading files outside a folder (including the HasPrefix bug and the new os.Root), shell injection, HTML escaping, request-size limits, weak randomness, bcrypt passwords, secrets in logs, SSRF, and scanning dependencies with govulncheck.
Sign in free to read this script, along with the rest of the library.
Sign in free