golint-sl

Appearance

dataflow

About 458 words

SSA-based data flow and taint analysis.

Category

Architecture

What It Checks

This analyzer uses Static Single Assignment (SSA) form to trace values and reports:

  • A parameter whose name names a credential reaching a logging or printing call, directly, through other values derived from it, or as a variadic argument (fmt.Println(password), log.Printf("%s", password), slog.Info("login", "pw", password)). Logging calls are the fmt print functions (Print, Printf, Println and their Fprint forms, not Sprint or Errorf) and any function of a logging package: one with an import path element such as log, slog, zap, logrus, zerolog or logging.
  • A call, in a function that has a context.Context, to a function whose first parameter is a context but that is passed none.

A name names a credential when its last word, splitting at underscores, hyphens and camelCase boundaries, is a credential word (dbPassword, authToken, clientSecret, awsCreds) or key after api, private, access, secret or signing (apiKey, PRIVATE_KEY). A bare key, names that only contain a credential word (author, tokenizer) and names where it qualifies another word (secretName, tokenURL) are not sensitive; hardcodedcreds uses the same rule.

The package also exports TaintAnalysis, a small taint tracker that records each logging, SQL, command execution and file write call a marked value reaches.

Why It Matters

Data flow analysis can detect:

  • Sensitive data flowing to insecure outputs
  • Unvalidated input reaching critical operations
  • Data dependencies that affect correctness

How It Works

SSA transforms code into a form where each variable is assigned exactly once, making data flow explicit:

// Original code
x := 1
x = x + 1
y := x

// SSA form (conceptual)
x1 := 1
x2 := x1 + 1
y1 := x2

This makes it possible to track where values come from and where they flow to.

Examples

Detected: Tainted Data

func HandleRequest(w http.ResponseWriter, r *http.Request) {
    userInput := r.URL.Query().Get("data")  // Tainted source

    // Tainted data flows directly to output
    fmt.Fprintf(w, userInput)  // Potential XSS!
}

Good: Sanitized

func HandleRequest(w http.ResponseWriter, r *http.Request) {
    userInput := r.URL.Query().Get("data")  // Tainted source

    // Sanitize before output
    safe := html.EscapeString(userInput)
    fmt.Fprintf(w, safe)  // OK
}

Detected: Sensitive Data Logged

func Login(username, password string) {
    log.Printf("Login attempt: %s:%s", username, password)  // Password logged!
}

Performance

SSA analysis is more expensive than AST analysis. For large codebases, you may want to:

  • Run it only in CI, not pre-commit
  • Disable it for faster local development

Configuration

# .golint-sl.yaml
analyzers:
  dataflow: true  # enabled by default

When to Disable

  • Performance-sensitive local development
  • Projects where data flow patterns are simple
analyzers:
  dataflow: false

See Also