Validation of integers needs a review

lojikil commented 4 years ago

I'm just picking on integers right now, because that's top of mind, but:

strconv.Atoi is almost never correct; I cover this in a few different talks
We list strconv.ParseInt but not ParseUint (thanks @disconnect3d for pointing that out)
We need to explain that many things take flows that are int but can pun those flows to int32 or int64 or uint flavors without the compiler complaining, but can lead to various issues. I spoke about this vis-a-vis Kubernetes in my talk at OWASP Global AppSec DC.

ErezYalon commented 4 years ago

These are interesting @lojikil. You are more than welcome to contribute.

lojikil commented 3 years ago

@ErezYalon I actually spoke with @PauloASilva about these in OWASP Slack; I'll try to issue some PRs this week!

tusharxoxoxo commented 2 years ago

I would like to work on it. Please assign me this @ErezYalon

PauloASilva commented 2 years ago

@tusharxoxoxo feel free to open a PR with the required changes, with a reference to this issue.

Cheers, Paulo A. silva

OWASP / Go-SCP