Function call made to an
unsafe package GSC-G103Use of unsafe calls should be audited
179func (chars *Chars) Prepend(prefix string) {
180 if runes := chars.optionalRunes(); runes != nil {
181 runes = append([]rune(prefix), runes...)
182 chars.slice = *(*[]byte)(unsafe.Pointer(&runes))183 } else {
184 chars.slice = append([]byte(prefix), chars.slice...)
185 }Use of unsafe calls should be audited
78 if chars.inBytes {
79 return nil
80 }
81 return *(*[]rune)(unsafe.Pointer(&chars.slice)) 82}
83
84func (chars *Chars) Get(i int) rune {Use of unsafe calls should be audited
63}
64
65func RunesToChars(runes []rune) Chars {
66 return Chars{slice: *(*[]byte)(unsafe.Pointer(&runes)), inBytes: false} 67}
68
69func (chars *Chars) IsBytes() bool {Use of unsafe calls should be audited
31 }
32 }
33 for ; i <= len(bytes)-4; i += 4 {
34 if (overflow32 & *(*uint32)(unsafe.Pointer(&bytes[i]))) > 0 { 35 return false, i
36 }
37 }Use of unsafe calls should be audited
26func checkAscii(bytes []byte) (bool, int) {
27 i := 0
28 for ; i <= len(bytes)-8; i += 8 {
29 if (overflow64 & *(*uint64)(unsafe.Pointer(&bytes[i]))) > 0 { 30 return false, i
31 }
32 }
Description
Package unsafe contains operations that step around the type safety of Go
programs and may be non-portable. Also note that unsafe package is not
supported by Go 1 compatibility guidelines.
Using the unsafe package in Go gives you low-level memory management and many C language
strengths but provides flexibility to your attacker's application. The pointer arithmetic
is one example of an unsafe package used for the data leak, memory corruption, or even
execution of the attacker's script. Also, it would be best to remember that Go 1 compatibility
guidelines do not protect the "unsafe" package.
Bad practice
package main
import (
"fmt"
"unsafe"
)
type Fake struct{}
func (Fake) Good() {}
func main() {
unsafeM := Fake{}
unsafeM.Good()
intArray := [...]int{1, 2}
fmt.Printf("
intArray: %v
", intArray)
intPtr := &intArray[0]
fmt.Printf("
intPtr=%p, *intPtr=%d.
", intPtr, *intPtr)
addressHolder := uintptr(unsafe.Pointer(intPtr)) + unsafe.Sizeof(intArray[0])
intPtr = (*int)(unsafe.Pointer(addressHolder))
fmt.Printf("
intPtr=%p, *intPtr=%d.
", intPtr, *intPtr)
}