Files
codeql/go/ql/test/query-tests/Security/CWE-078/CommandInjection.go
2026-06-11 07:15:54 +02:00

13 lines
239 B
Go

package main
import (
"net/http"
"os/exec"
)
func handler(req *http.Request) {
cmdName := req.URL.Query()["cmd"][0] // $ Source[go/command-injection]
cmd := exec.Command(cmdName) // $ Alert[go/command-injection]
cmd.Run()
}