Go Language – Web Application Secure Coding Practices
When I see anything that touches web coding practices for Go I always look up an area that I know best: sanitization.<p>I wrote <a href="https://github.com/microcosm-cc/bluemonday" rel="nofollow">https://github.com/microcosm-cc/bluemonday</a> which is a pure Go HTML sanitizer inspired by <a href="https://github.com/owasp/java-html-sanitizer" rel="nofollow">https://github.com/owasp/java-html-sanitizer</a> .<p>The key things to understand about HTML sanitizers:<p>* They must be whitelist based<p>* They must be aware of context<p>* You must sanitize <i>ALL</i> user input even if you don't think you're going to render it on a web page.<p>The book linked to in the article does not seem to understand any of the above.<p>The section on sanitization has the equivalent of "string replace" as the primary recommendation. Elsewhere in the XSS section a focus is on escaping content before it is rendered.<p>Sanitization needs to know not to run on <pre> blocks, and to escape HTML entities automatically, and to understand what links are safe and which are not.<p>XSS can be really interesting and quite targeted. It can be that a user-agent contains the XSS, because the target may not be the person reading the page but the admin looking at a web page of their web server logs through an analytics program on the same domain.<p>The bluemonday package I wrote can deal with all of these things but that isn't the point, the point is that this is an area I know and the book falls way short of a decent standard for creating a secure and safe web application. And if it falls short in this area (the first 2 chapters) then I would assume that it falls short in all areas.