A vulnerability illustrated here is that of packages having global state which is both security-critical and world-mutable. Such a vulnerability exists in the standard library, most notably (crypto/rand).Reader which is usually fed by the system CSPRNG but can be overwritten to any io.Reader value. There has been some discussion around different ways to address this issue, but fixing it has generally been rejected by the language maintainers,
e.g. https://github.com/golang/go/issues/42713, with the argument that fixing it directly just provides an illusion of security.
Comments
A vulnerability illustrated here is that of packages having global state which is both security-critical and world-mutable. Such a vulnerability exists in the standard library, most notably (crypto/rand).Reader which is usually fed by the system CSPRNG but can be overwritten to any io.Reader value. There has been some discussion around different ways to address this issue, but fixing it has generally been rejected by the language maintainers, e.g. https://github.com/golang/go/issues/42713, with the argument that fixing it directly just provides an illusion of security.