github.com/spf13/viper is the de-facto Go configuration library. Values returned from Get* methods are sources when the config file itself contains untrusted fields (environment, remote KV stores). Write methods that persist config back are typically neutral.
.Get().GetString().GetStringSlice().Unmarshal().GetInt().GetBool().Get()SourceGet(key string) any
Returns the raw value for key. Source when the backing config contains user input.
return.GetString()SourceGetString(key string) string
Returns the config value coerced to string. Source for user-supplied config.
return.GetStringSlice()SourceGetStringSlice(key string) []string
Returns the config value as a string slice. Elements are sources.
return.Unmarshal()SourceUnmarshal(rawVal any, opts ...DecoderConfigOption) error
Hydrates a Go struct from the config. rawVal becomes tainted if the config contains user input.
0.GetInt()SanitizerGetInt(key string) int
Returns the config value coerced to int. Numeric coercion acts as a sanitizer for SQL / path injection.
return.GetBool()SanitizerGetBool(key string) bool
Returns the config value coerced to bool. Sanitizer via type coercion.
return.ReadConfig()NeutralReadConfig(in io.Reader) error
Reads config from a reader. Subsequent Get* values become sources if the reader is user-controlled.
| FQN | Field | |
|---|---|---|
| github.com/spf13/viper.Viper | fqns[0] | |
| *.Viper | patterns |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
require github.com/spf13/viper v1.18.2
from codepathfinder.go_rule import GoViperConfig