Files
codeql/go/ql/test/query-tests/Security/CWE-640/EmailBad.go
2025-10-01 16:12:43 +01:00

14 lines
333 B
Go

package main
import (
"net/http"
"net/smtp"
)
func mail(w http.ResponseWriter, r *http.Request) {
host := r.Header.Get("Host") // $ Source
token := backend.getUserSecretResetToken(email)
body := "Click to reset password: " + host + "/" + token
smtp.SendMail("test.test", nil, "from@from.com", nil, []byte(body)) // $ Alert
}