Go-SCP
Go-SCP copied to clipboard
Validation of integers needs a review
I'm just picking on integers right now, because that's top of mind, but:
-
strconv.Atoi
is almost never correct; I cover this in a few different talks - We list
strconv.ParseInt
but notParseUint
(thanks @disconnect3d for pointing that out) - We need to explain that many things take flows that are
int
but can pun those flows toint32
orint64
oruint
flavors without the compiler complaining, but can lead to various issues. I spoke about this vis-a-vis Kubernetes in my talk at OWASP Global AppSec DC.
These are interesting @lojikil. You are more than welcome to contribute.
@ErezYalon I actually spoke with @PauloASilva about these in OWASP Slack; I'll try to issue some PRs this week!
I would like to work on it. Please assign me this @ErezYalon
@tusharxoxoxo feel free to open a PR with the required changes, with a reference to this issue.
Cheers, Paulo A. silva