golang/go

x/tools/go/analysis/structtag: stricter JSON tag checking

Open

#74376 opened on Jun 25, 2025

View on GitHub
 (6 comments) (11 reactions) (0 assignees)Go (133,883 stars) (19,008 forks)batch import
AnalysisProposalProposal-Acceptedhelp wanted

Description

Background: This recent article https://blog.trailofbits.com/2025/06/17/unexpected-security-footguns-in-gos-parsers/ describes (among other things) a number of security weaknesses in Go's encoding/json package. Some of these could be mitigated by better static checking of struct field tags; indeed, the author of the post links to two semgrep rules that enforce these checks. Specifically:

  • semgrep -c r/trailofbits.go.unmarshal-tag-is-dash
  • semgrep -c r/trailofbits.go.unmarshal-tag-is-omitempty

Proposal: Let's add these two checks to the structtag analyzer so that users get immediate feedback in their LSP-enabled editor, and whenever they run go vet.

Contributor guide

Tech stack
go
Domain
securitytooling
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Gogo/analysisstruct tagsencoding/json
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60
Research direction
Start by reading the referenced Trail of Bits blog post and the two semgrep rules to understand the desired checks. Then examine the existing structtag analyzer in golang.org/x/tools/go/analysis/passes/structtag to see its structure and how it reports issues. The implementation should add two new checks that detect JSON tags set to ' ' in Unmarshal contexts and missing 'omitempty' on fields that could cause security issues. Check the issue comments for any maintainer guidance.