Go 代码审计 - 漏洞Sink点

// 方案2：参数白名单+绝对路径
hostname := r.FormValue("host")
allowedHosts := map[string]bool{
    "google.com":  true,
    "github.com":  true,
    "example.com": true,
}

if !allowedHosts[hostname] {
    http.Error(w, "Host not allowed", 400)
    return
}

cmd := exec.Command("/bin/ping", "-c", "4", hostname)
cmd.Stdout = w
cmd.Stderr = w
err := cmd.Run()

import (
    "crypto/md5"
    "fmt"
    "io"
    "path/filepath"
    "strings"
)

func handleFileUpload(w http.ResponseWriter, r *http.Request) {
    r.ParseMultipartForm(10 * 1024 * 1024)
    
    file, header, err := r.FormFile("upload")
    if err != nil {
        http.Error(w, "Upload error", 400)
        return
    }
    defer file.Close()
    
    ext := filepath.Ext(header.Filename)
    allowedExts := map[string]bool{
        ".jpg": true, ".jpeg": true, ".png": true, ".gif": true,
    }
    
    if !allowedExts[strings.ToLower(ext)] {
        http.Error(w, "File type not allowed", 400)
        return
    }
    
    buf := make([]byte, 512)
    n, _ := file.Read(buf)
    mimeType := http.DetectContentType(buf[:n])
    file.Seek(0, 0)
    
    allowedMimes := map[string]bool{
        "image/jpeg": true,
        "image/png":  true,
        "image/gif":  true,
    }
    
    if !allowedMimes[mimeType] {
        http.Error(w, "Invalid MIME type", 400)
        return
    }
    
    hash := md5.Sum(buf[:n])
    filename := fmt.Sprintf("%x%s", hash, ext)
    
    uploadDir := "uploads"
    filepath := filepath.Join(uploadDir, filename)
    absPath, _ := filepath.Abs(filepath)
    absDir, _ := filepath.Abs(uploadDir)
    
    if !strings.HasPrefix(absPath, absDir) {
        http.Error(w, "Invalid path", 400)
        return
    }
    
    dst, err := os.OpenFile(filepath, os.O_CREATE|os.O_WRONLY, 0644)
    if err != nil {
        http.Error(w, "Save error", 500)
        return
    }
    defer dst.Close()
    
    io.Copy(dst, file)
    w.WriteHeader(http.StatusOK)
}

func readFileSafely(w http.ResponseWriter, r *http.Request) {
    filename := r.FormValue("file")
    
    safeName := filepath.Base(filename)
    baseDir := "files"
    filepath := filepath.Join(baseDir, safeName)
    absPath, _ := filepath.Abs(filepath)
    absBaseDir, _ := filepath.Abs(baseDir)
    
    if !strings.HasPrefix(absPath, absBaseDir) {
        http.Error(w, "Access denied", 403)
        return
    }
    
    content, err := ioutil.ReadFile(filepath)
    if err != nil {
        http.Error(w, "File not found", 404)
        return
    }
    
    w.Header().Set("Content-Type", "text/plain")
    w.Write(content)
}

import (
    "net"
    "net/url"
)

func isPrivateIP(ip string) bool {
    parsedIP := net.ParseIP(ip)
    return parsedIP.IsLoopback() || parsedIP.IsPrivate() || parsedIP.IsLinkLocalUnicast()
}

func validateURL(urlStr string) error {
    parsedURL, err := url.Parse(urlStr)
    if err != nil {
        return err
    }
    
    if parsedURL.Scheme != "http" && parsedURL.Scheme != "https" {
        return fmt.Errorf("invalid scheme: %s", parsedURL.Scheme)
    }
    
    ips, err := net.LookupIP(parsedURL.Hostname())
    if err != nil {
        return err
    }
    
    for _, ip := range ips {
        if isPrivateIP(ip.String()) {
            return fmt.Errorf("private IP address not allowed")
        }
    }
    
    whitelist := map[string]bool{
        "example.com":     true,
        "api.example.com": true,
    }
    
    if !whitelist[parsedURL.Hostname()] {
        return fmt.Errorf("domain not in whitelist")
    }
    
    return nil
}

func handleFetch(w http.ResponseWriter, r *http.Request) {
    urlStr := r.FormValue("url")
    
    if err := validateURL(urlStr); err != nil {
        http.Error(w, err.Error(), 400)
        return
    }
    
    client := &http.Client{Timeout: 10 * time.Second}
    resp, err := client.Get(urlStr)
    if err != nil {
        http.Error(w, "Fetch error", 500)
        return
    }
    defer resp.Body.Close()
    
    io.Copy(w, resp.Body)
}