Security analysis of Go services
In this section, we are going to briefly review another aspect of security that is often called application security. This area of security primarily focuses on various issues regarding application code and logic, including the following:
- Code injection: Executing arbitrary commands (for example, by running the
os.Execfunction with arguments provided by the user). - Hardcoded secrets: Using hardcoded secrets that might be compromised when application logic is executed (for example, in service logs or API responses).
- Weak cryptographic practices: Some cryptographic libraries, such as
crypto/md5orcrypto/sha1, are considered to offer weak protection mechanisms against various types of inputs. It’s suggested that they’re replaced with more secure counterparts (for example,crypto/sha256orcrypto/sha512). - SQL injection: Running SQL commands without proper protection against user-provided arguments might expose...
