The io standard library package. ReadAll and Copy move data from readers — sources when the underlying reader is user-controlled (e.g. an http.Request.Body). WriteString writes to a writer and is a sink when the writer is an HTTP response.
.ReadAll().ReadFull().WriteString().ReadAll()SourceReadAll(r Reader) ([]byte, error)
Reads from r until EOF and returns the result. Source when r wraps user input.
return.ReadFull()SourceReadFull(r Reader, buf []byte) (n int, err error)
Reads exactly len(buf) bytes from r. Buffer becomes tainted if r is user-controlled.
1.WriteString()SinkWriteString(w Writer, s string) (n int, err error)
Writes s to w. Sink when w is a response writer and s is user-controlled (XSS).
1.Copy()NeutralCopy(dst Writer, src Reader) (written int64, err error)
Copies from src to dst. Neutral data-transfer primitive; taint transits src → dst.
.CopyN()NeutralCopyN(dst Writer, src Reader, n int64) (written int64, err error)
Copies exactly n bytes from src to dst. Same as Copy.
.NopCloser()NeutralNopCloser(r Reader) ReadCloser
Wraps r in a no-op ReadCloser. Neutral transformation.
| FQN | Field | |
|---|---|---|
| io | fqns[0] | |
| io.* | patterns |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
// standard library — no go.mod entry required
from codepathfinder.go_rule import GoIO