mirror of
https://github.com/github/codeql.git
synced 2025-12-18 09:43:15 +01:00
43 lines
1.3 KiB
Go
43 lines
1.3 KiB
Go
package main
|
|
|
|
// see https://github.com/github/codeql-go/issues/48
|
|
|
|
import (
|
|
"database/sql"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io/ioutil"
|
|
"net/http"
|
|
)
|
|
|
|
func handler1(db *sql.DB, req *http.Request) {
|
|
// read data from request body and unmarshal to a indeterminacy struct
|
|
// POST: {"a": "b", "category": "test"}
|
|
var RequestDataFromJson map[string]interface{}
|
|
b, _ := ioutil.ReadAll(req.Body)
|
|
json.Unmarshal(b, &RequestDataFromJson)
|
|
|
|
q3 := fmt.Sprintf("SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='%s' ORDER BY PRICE",
|
|
RequestDataFromJson["category"])
|
|
db.Query(q3) // NOT OK
|
|
|
|
// read data from request body and unmarshal to a determined struct
|
|
// POST: {"id": "1", "category": "test"}
|
|
var RequestDataFromJson2 RequestStruct
|
|
b2, _ := ioutil.ReadAll(req.Body)
|
|
json.Unmarshal(b2, &RequestDataFromJson2)
|
|
|
|
q4 := fmt.Sprintf("SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='%s' ORDER BY PRICE",
|
|
RequestDataFromJson2.Category)
|
|
db.Query(q4) // NOT OK
|
|
|
|
// read json data from a url parameter
|
|
// GET: ?json={"id": 1, "category": "test"}
|
|
var RequestDataFromJson3 RequestStruct
|
|
json.Unmarshal([]byte(req.URL.Query()["json"][0]), &RequestDataFromJson3)
|
|
|
|
q5 := fmt.Sprintf("SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='%s' ORDER BY PRICE",
|
|
RequestDataFromJson3.Category)
|
|
db.Query(q5) // NOT OK
|
|
}
|