Smart (and simple) ways to prevent symlink attacks in Go
blog.trailofbits.com | blog | #secure-coding | #go | #vulnerabilities | #audit | #golang | #symlink | #file-handling | #symlink-attacks | #file-truncation
Summary
Go's os.Create silently truncates existing files, so a planted symlink can wipe data like logs. Trail of Bits explains why nil error checks miss this and how existence checks prevent symlink attacks.
- Published
- Collected
--- id: 1831 title: "Smart (and simple) ways to prevent symlink attacks in Go" source_domain: blog.trailofbits.com source_url: "https://blog.trailofbits.com/2020/11/24/smart-and-simple-ways-to-prevent-symlink-attacks-in-go/" published_at: "2020-11-24T13:00:04Z" tags: ["secure-coding", "go", "vulnerabilities", "audit", "golang", "symlink", "file-handling", "symlink-attacks", "file-truncation"] phying_url: "https://phying.com/item/1831" lang: en --- # Smart (and simple) ways to prevent symlink attacks in Go ## Summary Go's os.Create silently truncates existing files, so a planted symlink can wipe data like logs. Trail of Bits explains why nil error checks miss this and how existence checks prevent symlink attacks. ## Intelligence Metadata - **Sources:** blog.trailofbits.com - **Published:** 2020-11-24T13:00:04Z - **Original:** https://blog.trailofbits.com/2020/11/24/smart-and-simple-ways-to-prevent-symlink-attacks-in-go/ - **Phying News:** https://phying.com/item/1831