hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 22:32:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix frontend errors in ql/test/library-tests/semmle/go/frameworks/Websocket.

Browse Source
This commit is contained in:
Max Schaefer
2020-05-20 14:34:22 +01:00
parent 7e314f037a
commit 7773828347
2 changed files with 9 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ql/test/library-tests/semmle/go/frameworks/Websocket/DialFunction.expected
View File

@@ -1,8 +1,8 @@
| DialFunction.go:25:11:25:52 | call to Dial | DialFunction.go:25:26:25:39 | untrustedInput |
| DialFunction.go:28:12:28:39 | call to DialConfig | DialFunction.go:27:35:27:48 | untrustedInput |
| DialFunction.go:25:2:25:43 | call to Dial | DialFunction.go:25:17:25:30 | untrustedInput |
| DialFunction.go:28:2:28:29 | call to DialConfig | DialFunction.go:27:35:27:48 | untrustedInput |
| DialFunction.go:30:2:30:49 | call to Dial | DialFunction.go:30:30:30:43 | untrustedInput |
| DialFunction.go:33:2:33:38 | call to Dial | DialFunction.go:33:14:33:27 | untrustedInput |
| DialFunction.go:35:2:35:61 | call to DialContext | DialFunction.go:35:37:35:50 | untrustedInput |
| DialFunction.go:33:2:33:33 | call to Dial | DialFunction.go:33:14:33:27 | untrustedInput |
| DialFunction.go:35:2:35:56 | call to DialContext | DialFunction.go:35:37:35:50 | untrustedInput |
| DialFunction.go:37:2:37:44 | call to Dial | DialFunction.go:37:30:37:43 | untrustedInput |
| DialFunction.go:40:2:40:45 | call to Dial | DialFunction.go:40:31:40:44 | untrustedInput |
| DialFunction.go:42:2:42:31 | call to BuildProxy | DialFunction.go:42:17:42:30 | untrustedInput |

11
ql/test/library-tests/semmle/go/frameworks/Websocket/DialFunction.go
View File

@@ -17,22 +17,22 @@ import (
)
func main() {
untrustedInput := r.Referer()
untrustedInput := "referrer"
origin := "http://localhost/"
// bad as input is directly passed to dial function
ws, _ := websocket.Dial(untrustedInput, "", origin)
websocket.Dial(untrustedInput, "", origin)
config, _ := websocket.NewConfig(untrustedInput, origin) // good
ws2, _ := websocket.DialConfig(config)
websocket.DialConfig(config)
nhooyr.Dial(context.TODO(), untrustedInput, nil)
dialer := gorilla.Dialer{}
dialer.Dial(untrustedInput, r.Header)
dialer.Dial(untrustedInput, nil)
dialer.DialContext(context.TODO(), untrustedInput, r.Header)
dialer.DialContext(context.TODO(), untrustedInput, nil)
gobwas.Dial(context.TODO(), untrustedInput)
@@ -41,5 +41,4 @@ func main() {
sac.BuildProxy(untrustedInput)
sac.New(untrustedInput)
}