https://github.com/rootVIII/pdfinverter/blob/master/utils.go... using go to wrap a python script - this is some "hacker man" stuff right here
return bytes.ReplaceAll(script, []byte{0x09}, []byte{0x20, 0x20, 0x20, 0x20})
bytes.ReplaceAll(script, []byte("\t"), []byte(" "))
The most egregious is that the use of a python script has a security issue. Let's see if you can spot it, it's in these lines:
tmp := fmt.Sprintf("/var/tmp/invertpdf--%s/", time.Now().Format("20060102150405"))
os.Mkdir(tmp, 0700)
WriteText(tmp+"pngtopdf.py", GetPDFConv())
// later execute that .py file
"But", you might say, "WriteText does an os.Exit if it can't write the file". That doesn't matter. If i create the directory with permissions 777, and then have a program waiting for the python script to be written in order to replace it with a malicious script, Mkdir will error (dir already exists), but WriteText will succeed, and so the vulnerability still happens.
This is the sort of dumb vulnerability you get if you don't know that `ioutil.TempDir` exists (or don't know about symlink races, tmpdir races, etc). `ioutil.TempDir("/var/tmp", "invertpdf-")` would be the more secure way to do this, though obviously you still should check that error too.
There's a lot of other problems with this program, but this vulnerability is the most obvious.