Octal-Looking File Mode

ID

go.octal_looking_filemode

Severity

high

Remediation Complexity

simple

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Go

Tags

CWE:687, reliability, suspicious

Description

Reports a decimal integer literal passed as the permission (file-mode) argument of a filesystem call such as os.Chmod, os.Mkdir, os.MkdirAll, os.OpenFile or os.WriteFile, when the literal looks like an octal file mode written without its leading zero — for example os.Chmod(p, 644).

Rationale

File modes are conventionally octal (0644). A decimal 644 is a completely different bit pattern (decimal 644 equals octal 1204), so the resulting permissions are almost never what the author intended — and getting them wrong is a security-relevant mistake. The check resolves the call by its qualified name, looks at its permission argument, and fires only when that argument is a bare three- or four-digit decimal literal whose digits are all valid octal digits. A proper octal literal (0644, 0o644) or a variable mode is left alone.

import "os"

func fn(p string) {
    _ = os.Chmod(p, 644)  // FLAW — decimal 644 is not octal 0644
    _ = os.Chmod(p, 0644) // OK — proper octal literal
}

Remediation

Write the file mode as an octal literal with its leading 0 (or 0o) prefix, for example 0644.

References