racy-append-to-slice.yaml

rules:
  - id: racy-append-to-slice
    message: >-
      Appending `$SLICE` from multiple goroutines is not concurrency safe
    languages: [go]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
      subcategory: [vuln]
      confidence: MEDIUM
      likelihood: HIGH
      impact: MEDIUM
      technology: [--no-technology--]
      description: "Concurrent calls to `append` from multiple goroutines"
      references:
        - https://go.dev/blog/maps#concurrency

    patterns:
      - pattern: |
          $SLICE = append($SLICE, $ITEM)
      - pattern-either:
          - pattern-inside: |
              var $SLICE []$TYPE
              ...
              for ... {
                ...
                go func(...) {
                  ...
                  $SLICE = append($SLICE, ...)
                  ...
                }(...)
                ...
              }
          - pattern-inside: |
              $SLICE := make([]$TYPE, ...)
              ...
              for ... {
                ...
                go func(...) {
                  ...
                  $SLICE = append($SLICE, ...)
                  ...
                }(...)
                ...
              }
      - pattern-not-inside: |
          $MUTEX.Lock()
          ...
          $MUTEX.Unlock()
      - pattern-not-inside: |
          $MUTEX.Lock()
          ...
          defer $MUTEX.Unlock()
          ...