Skip to content

Update Go fileread rule to include "os.ReadFile" for CWE-22

Jamie Reid requested to merge jr-update-go-fileread-rule into main

The current go/filesystem/rule-filereadtaint.yml rule doesn't pick up on os.ReadFile calls as a path traversal risk. This MR introduces similar exclusions as used for os.OpenFile, and a pattern match looking for "os.ReadFile($ARG, ...)" where an arg is not bounded by Clean/Rel or other protections.

Merge request reports