Security with Go

Contaminated files

If an attacker finds an LFI, or you provide a web interface to log files, you need to make sure that, even if the logs are contaminated, no code will execute.

An attacker can potentially contaminate your logs and insert malicious code by taking some action on your service that creates a log entry. Any service that generates a log that is loaded or displayed must be considered.

For example, web server logs can be contaminated by making an HTTP request to a URL that is actually code. Your logs will have a 404 Not Found error and log the URL that was requested, which is actually code. If it were a PHP server or another scripted language, this opens up potential code execution, but, with Go, the worst case would be JavaScript ...