Go security pitfalls; 2 lessons from the battlefield at Grafana Labs
summary
Two real Grafana bugs are dissected: filepath.Clean misinterprets inputs where cleaning user paths still allows dot-dot sequences so plugin file access exposes configs and secrets, fixed by normalizing with a leading slash plus fuzz tests and regression cases; and slice sharing race leads to auth bypass where middleware slices are shared under concurrent requests, allowing an unauthenticated request to inherit an admin middleware and reset passwords, reproduced with k6 load tests, fixed by copying slices on request creation and validated by replaying the same load.
AI-written summary · about
chapters (18)
- 0:00Start
- 2:45Go, a secure language
- 4:17Grafana: Our first O-day in December 2021
- 6:42filepath.Clean is tricky
- 8:38The vulnerable code
- 10:16The fixed code
- 12:36Go Fuzzing example 1: validation logic
- 12:54Go Fuzzing example 1: writing the predicates
- 14:36Go Fuzzing example 1: fixing the predicates
- 16:39Go Fuzzing example 2: validation logic
- 18:16Go Fuzzing example 2: abstracting the predicates
- 18:57Go Fuzzing example 2: writing the predicates
- 20:15Go Fuzzing example 2: finding a corner case
- 24:42Why appending to slice is dangerous?
- 26:56The vulnerable (?) code and the fix
- 29:27Exploiting the bug
- 41:41Bug bounty program
- 42:03Key takeaways
related talks
14mThreat Modeling for O11y: From Blind Spots to Actionable Insight
39mHack the Docs how security professionals use documentation
23mGraphQL Security Vulnerabilities in the Wild
19mCritical Security Mistakes in Frontend Applications
24mWhy security fails, and how we can solve for it
29mGraphQL Security Best Practices and Hardening
22mThe Hidden Access Paths to Smaugs Cavern
22mI Followed the Best Practices and Still Got Hacked