mirror of
https://github.com/github/codeql.git
synced 2026-07-24 04:32:03 +02:00
19 lines
352 B
Go
19 lines
352 B
Go
package main
|
|
|
|
import (
|
|
"net/http"
|
|
)
|
|
|
|
func handler(w http.ResponseWriter, req *http.Request) {
|
|
target := req.FormValue("target") // $ Source
|
|
|
|
// BAD: `target` is controlled by the attacker
|
|
resp, err := http.Get("https://" + target + ".example.com/data/") // $ Alert
|
|
if err != nil {
|
|
// error handling
|
|
}
|
|
|
|
// process request response
|
|
use(resp)
|
|
}
|