feat: Support for adding taint analysis engine #1486

ravisastryk · 2026-01-28T03:35:24Z

Taint Analysis Engine for gosec

Implements a minimal, zero-dependency taint analysis engine for gosec that tracks data flow from sources (user input) to sinks (dangerous functions) to detect security vulnerabilities.

Issue: #1160 - Request for taint analysis support in gosec

New Security Rules

Rule ID	Vulnerability	CWE	Severity
G701	SQL Injection	CWE-89	HIGH
G702	Command Injection	CWE-78	CRITICAL
G703	Path Traversal	CWE-22	HIGH
G704	SSRF	CWE-918	HIGH
G705	XSS	CWE-79	MEDIUM
G706	Log Injection	CWE-117	LOW

Changes

Uses only golang.org/x/tools packages that gosec already depends on
Leverages Static Single Assignment form for precise data flow tracking
Uses Class Hierarchy Analysis (CHA) for sound call graph construction
Easy to add new sources and sinks via configuration

Example Detection

SQL Injection (G701):

func handler(db *sql.DB, r *http.Request) {
    name := r.URL.Query().Get("name")  // SOURCE: user input
    query := "SELECT * FROM users WHERE name = '" + name + "'"
    db.Query(query)  // SINK: G701 detected here
}

Command Injection (G702):

func handler(w http.ResponseWriter, r *http.Request) {
    cmd := r.URL.Query().Get("cmd")  // SOURCE: user input
    exec.Command("sh", "-c", cmd).Run()  // SINK: G702 detected here
}

codecov-commenter · 2026-01-28T03:51:39Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 67.22689% with 117 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.36%. Comparing base (1216c9b) to head (bf684e2).
⚠️ Report is 177 commits behind head on master.

Files with missing lines	Patch %	Lines
analyzers/taint/taint.go	54.45%	68 Missing and 19 partials ⚠️
analyzers/taint/analyzer.go	43.39%	29 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1486      +/-   ##
==========================================
+ Coverage   68.49%   69.36%   +0.86%     
==========================================
  Files          75       88      +13     
  Lines        4384     7089    +2705     
==========================================
+ Hits         3003     4917    +1914     
- Misses       1233     1924     +691     
- Partials      148      248     +100

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

ravisastryk · 2026-01-28T03:52:26Z

@ccojocar Please review when you get a chance. TIA

Implements SSA-based taint analysis to detect security vulnerabilities: - G701: SQL injection via string concatenation - G702: Command injection via user input - G703: Path traversal via user input - G704: SSRF via user-controlled URLs - G705: XSS via unescaped user input - G706: Log injection via user input Uses golang.org/x/tools for SSA/call graph analysis with CHA. Zero external dependencies beyond existing gosec imports.

ccojocar · 2026-01-28T09:30:11Z

Thanks for submitting this. I will need some time to review it. Which AI code generator are you using?

ravisastryk · 2026-01-28T14:55:03Z

Thanks for submitting this. I will need some time to review it. Which AI code generator are you using?

Thank you for asking @ccojocar. Claude helped with initial scaffolding, and I handled the refinements and final implementation to improve further. Please take your time reviewing. I am interested to see this reach a wider audience and encourage broader gosec adoption. Thank you for your time again.

ccojocar · 2026-01-31T07:46:43Z

analyzers/taint/taint.go

+
+// Source defines where tainted data originates.
+// Format: "package/path.TypeOrFunc" or "*package/path.Type" for pointer types.
+type Source struct {


Can you add a go doc comment on each field?

ccojocar · 2026-01-31T07:47:03Z

analyzers/taint/taint.go

+// Format: "package/path.TypeOrFunc" or "*package/path.Type" for pointer types.
+type Source struct {
+	Package string // e.g., "net/http"
+	Name    string // e.g., "Request" or "Get"


Is this function/method name? Can you make the name more clear?

ccojocar · 2026-01-31T07:47:25Z

analyzers/taint/taint.go

+
+// Sink defines a dangerous function that should not receive tainted data.
+// Format: "(*package/path.Type).Method" or "package/path.Func"
+type Sink struct {


Please add go doc on each field.

ccojocar · 2026-01-31T07:48:17Z

analyzers/taint/taint.go

+}
+
+// Result represents a detected taint flow from source to sink.
+type Result struct {


Please add a go doc on each field.

ccojocar · 2026-01-31T07:49:12Z

analyzers/taint/taint.go

+
+// Analyzer performs taint analysis on SSA programs.
+type Analyzer struct {
+	config    Config


I would use a pointer for config.

ccojocar · 2026-01-31T09:07:46Z

analyzers/taint/configs.go

+			{Package: "net/http", Method: "Get"},
+			{Package: "net/http", Method: "Post"},
+			{Package: "net/http", Method: "Head"},
+			{Package: "net/http", Method: "PostForm"},


http.NewRequest missing

net.Dial, net.DialTImeout, net.LookupHost

net/http/httputil.ReverseProxy:

net/http/httputil NewSingleHostReverseProxy

ccojocar · 2026-01-31T09:09:23Z

analyzers/taint/configs.go

+// XSS returns a configuration for detecting Cross-Site Scripting vulnerabilities.
+func XSS() Config {
+	return Config{
+		Sources: []Source{


see sources above for a more complete list

ccojocar · 2026-01-31T09:10:25Z

analyzers/taint/configs.go

+			{Package: "net/http", Name: "Request", Pointer: true},
+			{Package: "net/url", Name: "Values"},
+		},
+		Sinks: []Sink{


template.HTML, template.HTMLAttr, template.JS, template.CSS missing

ccojocar · 2026-01-31T09:11:02Z

analyzers/taint/configs.go

+func LogInjection() Config {
+	return Config{
+		Sources: []Source{
+			{Package: "net/http", Name: "Request", Pointer: true},


see above for a more complete list of sources

ccojocar · 2026-01-31T09:12:04Z

analyzers/taint/configs.go

+			{Package: "log", Method: "Println"},
+			{Package: "log", Method: "Fatal"},
+			{Package: "log", Method: "Fatalf"},
+			{Package: "log", Method: "Fatalln"},


log.Panic, log/slog.Info, Error, Warn

ravisastryk force-pushed the feature/taint-analysis-engine branch from 242671d to 105052f Compare January 28, 2026 03:44

ravisastryk changed the title ~~feat: add taint analysis engine for data flow security~~ feat: Support for adding taint analysis engine Jan 28, 2026

ravisastryk mentioned this pull request Jan 28, 2026

Create a taint analysis engine #1160

Open

ravisastryk marked this pull request as ready for review January 28, 2026 03:51

ravisastryk force-pushed the feature/taint-analysis-engine branch 4 times, most recently from a653518 to a5dd1eb Compare January 28, 2026 06:23

ravisastryk force-pushed the feature/taint-analysis-engine branch from a5dd1eb to bf684e2 Compare January 28, 2026 06:33

ccojocar requested changes Jan 31, 2026

View reviewed changes

Uh oh!

feat: Support for adding taint analysis engine #1486

Are you sure you want to change the base?

feat: Support for adding taint analysis engine #1486

Uh oh!

Conversation

ravisastryk commented Jan 28, 2026

Taint Analysis Engine for gosec

New Security Rules

Changes

Example Detection

Uh oh!

codecov-commenter commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ravisastryk commented Jan 28, 2026

Uh oh!

ccojocar commented Jan 28, 2026

Uh oh!

ravisastryk commented Jan 28, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov-commenter commented Jan 28, 2026 •

edited

Loading