Psiphon-Labs/psiphon-tunnel-core

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /psiphon/common/refraction/refraction.go line 919
Likely real: Yes, 99% confidence

Missing mutex unlock (`manager.ctxMutex` variable) before returning from a function. This could result in panics resulting from double lock operations

return nil, errors.Tracef("unexpected nil deadline")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /psiphon/common/tactics/tactics.go line 1475
Likely real: Yes, 99% confidence

Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention] (https://semgrep.dev/docs/cheat-sheets/go-xss/).

_, err = w.Write(boxedResponse)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /psiphon/internal/testutils/dsl.go line 343
Likely real: Yes, 99% confidence

Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention] (https://semgrep.dev/docs/cheat-sheets/go-xss/).

_, err = w.Write(response)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /psiphon/server/meek.go line 2275
Likely real: Yes, 99% confidence

Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention] (https://semgrep.dev/docs/cheat-sheets/go-xss/).

_, err = w.Write(packet)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /psiphon/common/light/proxy.go line 753
Likely real: Yes, 97% confidence

Calling `waitGroup.Add` inside of an anonymous goroutine may result in `waitGroup.Wait` waiting for more or less calls to `waitGroup.Done()` than expected

waitGroup := new(sync.WaitGroup)

	if proxy.config.EmitActivity {
		waitGroup.Add(1)
		go func() {
			defer waitGroup.Done()
			proxy.activityUpdate(ctx)
		}()
	}

	for _, listener := range listeners {
		listener := listener
		waitGroup.Add(1)
		go func() {
			defer waitGroup.Done()
			for {
				conn, err := listener.Accept()
				if err != nil {
					if ctx.Err() != nil {
						break
					}
					proxy.eventReceiver.WarningLog(
						proxy.ID, errors.Trace(err).Error())
					continue
				}
				if proxy.paused.Load() {

					// Immediately close the accepted TCP connection when paused.
					// Clients will observe a fast failure.
					//
					// Future enhancement: close the listener while paused, to
					// avoid the load of accepting TCP connections.
					// Alternatively, for certain proxy load patterns it may be
					// more optimal to accept the connection and, rather than
					// immediately close it, enqueue for a short time in
					// anticipation of resume.

					conn.Close()
					proxy.eventReceiver.Rejected() // Blocks accept loop
					continue
				}
				waitGroup.Add(1)
				go func(conn net.Conn) {
					defer waitGroup.Done()
					proxy.eventReceiver.Accepted()
					err := proxy.handleConn(ctx, conn)
					if err != nil && ctx.Err() == nil {
						proxy.eventReceiver.WarningLog(
							proxy.ID, errors.Trace(err).Error())
					}
				}(conn)
			}
		}()
	}

	<-ctx.Done()
	closeListeners()
	waitGroup.Wait()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /MobileLibrary/go-mobile/cmd/gomobile/bind_iosapp.go line 63
Likely real: Uncertain, 47% confidence