mirror of
https://github.com/github/codeql.git
synced 2025-12-22 03:36:30 +01:00
17 lines
349 B
Go
17 lines
349 B
Go
package main
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"regexp"
|
|
)
|
|
|
|
func checkRedirect(req *http.Request, via []*http.Request) error {
|
|
// BAD: the host of `req.URL` may be controlled by an attacker
|
|
re := "^((www|beta).)?example.com/"
|
|
if matched, _ := regexp.MatchString(re, req.URL.Host); matched {
|
|
return nil
|
|
}
|
|
return errors.New("Invalid redirect")
|
|
}
|