Security assessment techniques for Go projects

Summary: Trail of Bits adapted its security assessment techniques to Go after an influx of Go projects, focusing on commonly misunderstood language semantics including scoping, coroutines, error handling, and dependency management. The firm recommends gosec, go-vet, and staticcheck at minimum for static analysis, and describes dynamic approaches including dvyukov/go-fuzz, property testing with gopter, and its KRF fault injection tool, which surfaced a bug in a vendored Kubernetes dependency during its assessment.
Key Takeaway: The Kubernetes finding shows how far a single fault can travel: a faulted ionice command sent an error to STDERR, execution continued instead of returning it, and STDOUT was later indexed, causing an index out of range runtime panic deep inside a vendored dependency.

Read the original at Trail of Bits Blog ↗