Files
codeql/go/ql/test/query-tests/Security/CWE-089/StringBreak.go
2026-06-11 07:15:54 +02:00

18 lines
394 B
Go

package main
import (
"encoding/json"
"fmt"
sq "github.com/Masterminds/squirrel"
)
func save(id string, version interface{}) {
versionJSON, _ := json.Marshal(version) // $ Source[go/unsafe-quoting]
sq.StatementBuilder.
Insert("resources").
Columns("resource_id", "version_md5").
Values(id, sq.Expr(fmt.Sprintf("md5('%s')", versionJSON))). // $ Alert[go/unsafe-quoting]
Exec()
}