Unsafe File Upload

Description

File upload processed without type validation, size limits, or filename sanitization.

What Shoulder detects

File upload lacks proper validation

How to fix

Validate file type, limit size, and use a generated filename.

```go
r.Body = http.MaxBytesReader(w, r.Body, 10*1024*1024) // 10 MB limit
file, header, _ := r.FormFile("file")

ext := filepath.Ext(header.Filename)
safeFilename := uuid.New().String() + ext
dst, _ := os.Create(filepath.Join("/var/uploads", safeFilename))
io.Copy(dst, file)
```

Learn more: https://shoulder.dev/learn/go/cwe-434/unsafe-file-upload

Applies to

Languages

🐹 Go

References

Documentation ↗ OWASP ↗ Learn about CWE-434

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=go-unsafe-file-upload .