G103: list of unsafe functions

[jeffreytolar]

gosec/rules/unsafe.go

Line 46 in 3952187

calls: []string{"Alignof", "Offsetof", "Sizeof", "Pointer"},

has a list of four unsafe functions. Of those, I think only the last (Pointer) is really a (potential) security concern - Alignof, Offsetof, Sizeof don't (by themselves) bypass the type system or memory safety checks.

I suspect they're in unsafe primarily because they aren't portable - you can get different values when compiling for different platforms. See also golang/go#5602

There are some new-ish unsafe functions that do potentially have security implications:

• unsafe.String (go1.20)
• unsafe.StringData (go1.20)
• unsafe.Slice (go1.17)
• unsafe.SliceData (go1.20)