mcp-server-semgrep/semgrep-rules/go/lang/security/audit/reflect-makefunc.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: reflect-makefunc
  message: >-
    'reflect.MakeFunc' detected. This will sidestep protections that are
    normally afforded by Go's type system. Audit this call and be sure that
    user input cannot be used to affect the code generated by MakeFunc;
    otherwise, you will have a serious security vulnerability.
  metadata:
    owasp:
    - A01:2021 - Broken Access Control
    cwe:
    - 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
    category: security
    technology:
    - go
    confidence: LOW
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
  severity: ERROR
  pattern: reflect.MakeFunc(...)
  languages:
  - go