Feature request: CAPABILITY_INIT
Open
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 52
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 4
Description
Packages which introduce [`init(...)`](https://go.dev/doc/effective_go#init) likely need to be audited: these are called during execution and mean that libraries can execute their own behavior at runtime regardless of whether or not affected methods are called.
E.g., it might be alright if `CAPABILITY_EXEC` was used in a library to help with command execution, but I'd in general be surprised about an `init(...)` function in that context and especially if `init(...)` called `exec(...)` in some way. Introduction (or initial use) of `init` in libraries should probably be audited, along with periodic re-reviews on version bumps.
Contributor guide
Assessment
This issue has not been assessed yet.