golint-sl

Appearance

dataflow

About 275 wordsLess than 1 minute

2025-01-16

SSA-based data flow and taint analysis.

Category

Architecture

What It Checks

This analyzer uses Static Single Assignment (SSA) form to perform:

  • Data flow analysis
  • Taint tracking
  • Value propagation analysis

Why It Matters

Data flow analysis can detect:

  • Sensitive data flowing to insecure outputs
  • Unvalidated input reaching critical operations
  • Data dependencies that affect correctness

How It Works

SSA transforms code into a form where each variable is assigned exactly once, making data flow explicit:

// Original code
x := 1
x = x + 1
y := x

// SSA form (conceptual)
x1 := 1
x2 := x1 + 1
y1 := x2

This makes it possible to track where values come from and where they flow to.

Examples

Detected: Tainted Data

func HandleRequest(w http.ResponseWriter, r *http.Request) {
    userInput := r.URL.Query().Get("data")  // Tainted source

    // Tainted data flows directly to output
    fmt.Fprintf(w, userInput)  // Potential XSS!
}

Good: Sanitized

func HandleRequest(w http.ResponseWriter, r *http.Request) {
    userInput := r.URL.Query().Get("data")  // Tainted source

    // Sanitize before output
    safe := html.EscapeString(userInput)
    fmt.Fprintf(w, safe)  // OK
}

Detected: Sensitive Data Logged

func Login(username, password string) {
    log.Printf("Login attempt: %s:%s", username, password)  // Password logged!
}

Performance

SSA analysis is more expensive than AST analysis. For large codebases, you may want to:

  • Run it only in CI, not pre-commit
  • Disable it for faster local development

Configuration

# .golint-sl.yaml
analyzers:
  dataflow: true  # enabled by default

When to Disable

  • Performance-sensitive local development
  • Projects where data flow patterns are simple
analyzers:
  dataflow: false

See Also