mirror of
https://github.com/github/codeql.git
synced 2026-08-04 01:13:00 +02:00
27 lines
562 B
Go
27 lines
562 B
Go
package main
|
|
|
|
import (
|
|
"net/http"
|
|
)
|
|
|
|
// BAD: taken from https://www.gorillatoolkit.org/pkg/websocket
|
|
func ex1(w http.ResponseWriter, r *http.Request) {
|
|
if r.Header.Get("Origin") != "http://"+r.Host { // $ Alert
|
|
//do something
|
|
}
|
|
}
|
|
|
|
// BAD: both operands are from remote sources
|
|
func ex2(w http.ResponseWriter, r *http.Request) {
|
|
if r.Header.Get("Origin") != "http://"+r.Header.Get("Header") { // $ Alert
|
|
//do something
|
|
}
|
|
}
|
|
|
|
// GOOD
|
|
func ex3(w http.ResponseWriter, r *http.Request) {
|
|
if r.Header.Get("Origin") != "http://"+"test" {
|
|
//do something
|
|
}
|
|
}
|