racy-append-to-slice.yaml

rules:
- id: racy-append-to-slice
  message: >-
    Appending `$SLICE` from multiple goroutines is not concurrency safe
  languages: [go]
  severity: ERROR
  metadata:
    category: security
    cwe: "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
    subcategory: [vuln]
    confidence: MEDIUM
    likelihood: HIGH
    impact: MEDIUM
    technology: [--no-technology--]
    description: "Concurrent calls to `append` from multiple goroutines"
    references:
      - https://go.dev/blog/maps#concurrency

  patterns:
    - pattern: |
          $SLICE = append($SLICE, $ITEM)
    - pattern-either:
      - pattern-inside: |
          var $SLICE []$TYPE
          ...
          for ... {
            ...
            go func(...) {
              ...
              $SLICE = append($SLICE, ...)
              ...
            }(...)
            ...
          }
      - pattern-inside: |
          $SLICE := make([]$TYPE, ...)
          ...
          for ... {
            ...
            go func(...) {
              ...
              $SLICE = append($SLICE, ...)
              ...
            }(...)
            ...
          }
    - pattern-not-inside: |
          $MUTEX.Lock()
          ...
          $MUTEX.Unlock()
    - pattern-not-inside: |
          $MUTEX.Lock()
          ...
          defer $MUTEX.Unlock()
          ...