unsafe-dll-loading.yaml

rules:
- id: unsafe-dll-loading
  message: >-
    The function is vulnerable to DLL hijacking attacks.
    Use `windows.NewLazySystemDLL()` function to limit DLL search to the Windows directory
  languages: [go]
  severity: ERROR
  metadata:
    category: security
    cwe: "CWE-427: Uncontrolled Search Path Element"
    subcategory: [vuln]
    confidence: HIGH
    likelihood: MEDIUM
    impact: HIGH
    technology: [--no-technology--]
    description: "Use of function vulnerable to DLL hijacking attacks"
    references:
      - https://pkg.go.dev/golang.org/x/sys/windows#LazyDLL

  patterns:
    - pattern-either:
        - pattern: syscall.LoadDLL(...)
        - pattern: syscall.LoadLibrary(...)
        - pattern: windows.LoadDLL(...)
        - pattern: windows.MustLoadDLL(...)
        - pattern: syscall.NewLazyDLL(...)
        - pattern: |
            $X = windows.NewLazyDLL(...)
            ...
            $X.$Y()
            ...
            $X.System = true
        - pattern: |
            $X = windows.NewLazyDLL(...)
            ...
            $X.$Y()
    - pattern-not: |
        $X = windows.NewLazyDLL(...)
        ...
        $X.System = true
        ...
        $X.$Y()