rules-go

Channel created. Ensure the sending goroutine closes it (or uses a done channel) to prevent receiving goroutines from blocking forever.

context.Context should not be stored in a struct — it should flow through function parameters. Store context in structs only for request-scoped objects where it is the canonical approach.

RISK: exec.Command launching a shell (sh/bash/zsh/cmd/powershell) runs whatever string you pass through the shell, so any attacker-controlled fragment becomes arbitrary command execution — CWE-78 command injection (the ssg hook already refuses Bash commands containing shell metacharacters for exactly this reason). FIX: exec.Command runs the target binary directly with no shell — call it with explicit args, e.g. exec.Command("git", "log", userArg), never exec.Command("sh", "-c", "git log "+userArg).

Exported function missing doc comment. Go convention: every exported symbol should have a comment starting with its name. Godoc will surface this.

Goroutine spawned. Ensure it is tracked with a sync.WaitGroup or context for clean shutdown — goroutine leaks are a common source of memory issues in long-running services like the ssg eval daemon.

RISK: http.Get/Post/Head and http.DefaultClient have NO request timeout by default, so a slow or hostile server can hang the goroutine indefinitely and leak connections — CWE-400 resource exhaustion. FIX: use a client with an explicit timeout — c := &http.Client{Timeout: 10 * time.Second}; c.Get(url) — and prefer http.NewRequestWithContext so the call honours context cancellation.

RISK: an http.Server literal with no ReadHeaderTimeout/ReadTimeout has unbounded header-read time, so a Slowloris client trickling bytes can pin connections until the listener is exhausted — CWE-400 resource exhaustion (the ssg dashboard server on 127.0.0.1:7901 is an http.Server). FIX: set ReadHeaderTimeout (and ReadTimeout/WriteTimeout/IdleTimeout), e.g. &http.Server{Handler: mux, ReadHeaderTimeout: 5 * time.Second, ReadTimeout: 15 * time.Second, WriteTimeout: 15 * time.Second}.

A return value is being discarded into the blank identifier (e.g. '_ = f()' or '_, _ = f()'). If any discarded slot is an error, this silently drops write/close/flush failures and can produce a success exit code on partial failure (CWE-252). FIX: capture and handle it — 'v, err := f(); if err != nil { return err }'. If the discard is genuinely intentional (e.g. defer f.Close() on a read-only fd), add a comment above the line stating why the error is safe to drop.

RISK: math/rand is a deterministic PRNG seeded from predictable state — using it to generate tokens, keys, nonces, salts, session IDs, or CSRF values lets an attacker predict or brute-force them — CWE-338 weak randomness for security. FIX: use crypto/rand — crypto/rand.Read(buf) for raw bytes, or crypto/rand.Int / Text — for any value that gates auth or secrecy.

sync.Mutex must not be copied after first use — copying a locked mutex causes a deadlock. Use a pointer receiver (*MyStruct) or pass by pointer.

Naked return detected. Named return values with bare 'return' reduce readability in longer functions. Prefer explicit return values.

panic() in library code crashes the entire program. Return an error instead and let the caller decide how to handle it. Reserve panic() for truly unrecoverable invariant violations that indicate a programmer bug.

RISK: feeding request-derived input (r.URL.Path, r.FormValue, r.PathValue, …) into filepath.Join lets '../' escape the intended directory and read or overwrite arbitrary files — CWE-22 path traversal. FIX: filepath.Clean the joined path, then verify it is still inside the base — e.g. p := filepath.Join(base, name); if !strings.HasPrefix(p, filepath.Clean(base)+string(os.PathSeparator)) { reject } — or use os.Root (Go 1.24+) to confine the open.

select statement without timeout or context cancellation can block indefinitely. Add a 'case <-ctx.Done():' or 'default:' branch to prevent goroutine leaks.

Single-letter variable outside a loop — consider a descriptive name. Single letters (except i/j/k in loops) make code harder to search and understand.

SQL built with fmt.Sprintf/Sprint/Fprintf and handed to db.Query/QueryRow/Exec/Prepare (or their *Context forms) interpolates input straight into the statement — classic SQL injection (CWE-89). FIX: use parameterized queries with placeholders — db.QueryContext(ctx, "SELECT * FROM t WHERE id = ?", id) — and never concatenate user input into the query string. SSG audit rows go through modernc.org/sqlite; keep every audit INSERT bound.

Avoid stuttering names like 'http.HTTPServer' — prefer 'http.Server'. Package name provides context; the type name should not repeat it.

time.Sleep() in non-test code often indicates a polling anti-pattern. Prefer channels, sync primitives, or ticker-based approaches for coordination.

RISK: tls.Config{InsecureSkipVerify: true} disables certificate and hostname verification, so any MITM can present a forged cert and intercept the TLS stream, stealing license JWTs / hub tokens — CWE-295 improper certificate validation. FIX: leave verification on; to trust a private CA, load it explicitly into RootCAs (x509.NewCertPool + AppendCertsFromPEM) rather than skipping verification.

RISK: setting MinVersion to SSL3.0/TLS1.0/TLS1.1 permits protocol versions broken by POODLE/BEAST and deprecated by RFC 8996 — CWE-295/326 weak transport. FIX: set MinVersion: tls.VersionTLS12 (or tls.VersionTLS13). Omitting MinVersion entirely also defaults to a weak floor on older Go, so set it explicitly.

Public function exposes unexported type in its signature — callers outside the package cannot reference it. Export the type or refactor the API.

The 'unsafe' package bypasses Go's type system and memory safety guarantees. Verify this is truly necessary — most use cases have safe alternatives. If FFI requires it, isolate it behind a safe wrapper and document the invariants.

RISK: crypto/md5 and crypto/sha1 are collision-broken and unfit for signatures, integrity manifests, or password hashing — CWE-327 broken crypto (SSG signs rulesets with Ed25519 and chains audit roots; a weak digest undermines that). FIX: use crypto/sha256 or crypto/sha512 for integrity; for passwords use bcrypt, scrypt, or argon2id from golang.org/x/crypto.

RISK: creating files/dirs with 0666 or 0777 makes them world-writable (and world-readable), so any local user can tamper with or read ~/.sigmashake state — license JWTs, tokens, the rules DB, the pending-audit buffer — CWE-276/732 insecure default permissions. FIX: use 0600 for private files (the ssg hook writes pending_audit.jsonl with 0o600), 0644 for public-read files, and 0700 for private directories.