feat: add G709 rule for unsafe deserialization of untrusted data

[ccojocar]

Summary

Add taint analysis rule G709 to detect unsafe deserialization of untrusted data (CWE-502).

When user-controlled input flows into deserialization functions like gob.NewDecoder, xml.Unmarshal, or yaml.v2.Unmarshal, attackers can exploit type instantiation mechanisms to achieve denial-of-service or remote code execution (e.g. CVE-2024-34156 for gob).

Sinks

Package	Function	Risk
encoding/gob	NewDecoder	HIGH — arbitrary type instantiation
encoding/xml	NewDecoder, Unmarshal	MEDIUM — deeply nested structure DoS
gopkg.in/yaml.v2	NewDecoder, Unmarshal	HIGH — arbitrary type via YAML tags

encoding/json is intentionally excluded (low risk, extremely common usage).

Tests

5 test samples: 3 positive (gob, xml.NewDecoder, xml.Unmarshal), 2 negative (local file gob, json).

Files Changed

• analyzers/unsafe_deserialization.go (new) — taint config
• testutils/g709_samples.go (new) — test samples
• analyzers/analyzerslist.go — registration
• cwe/data.go — CWE-502 entry
• issue/issue.go — G709->CWE-502 mapping
• analyzers/analyzerslist_test.go, analyzers/analyzers_test.go — tests
• RULES.md, README.md — docs

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.06%. Comparing base (e7ea237) to head (b6f6655).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1598      +/-   ##
==========================================
+ Coverage   81.00%   81.06%   +0.06%     
==========================================
  Files         105      106       +1     
  Lines        9997    10030      +33     
==========================================
+ Hits         8098     8131      +33     
  Misses       1408     1408              
  Partials      491      491              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.