rules:
- id: reflect-makefunc
  message: >-
    'reflect.MakeFunc' detected. This will sidestep protections that are
    normally afforded by Go's type system. Audit this call and be sure that
    user input cannot be used to affect the code generated by MakeFunc;
    otherwise, you will have a serious security vulnerability.
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
    category: security
    technology:
    - go
  severity: WARNING
  pattern: reflect.MakeFunc(...)
  languages:
  - go