Files
codeql/go/ql/test/experimental/CWE-840/condition.go
2026-06-11 07:15:54 +02:00

27 lines
562 B
Go

package main
import (
"net/http"
)
// BAD: taken from https://www.gorillatoolkit.org/pkg/websocket
func ex1(w http.ResponseWriter, r *http.Request) {
if r.Header.Get("Origin") != "http://"+r.Host { // $ Alert
//do something
}
}
// BAD: both operands are from remote sources
func ex2(w http.ResponseWriter, r *http.Request) {
if r.Header.Get("Origin") != "http://"+r.Header.Get("Header") { // $ Alert
//do something
}
}
// GOOD
func ex3(w http.ResponseWriter, r *http.Request) {
if r.Header.Get("Origin") != "http://"+"test" {
//do something
}
}