Files
codeql/go/ql/test/query-tests/Security/CWE-020/IncompleteUrlSchemeCheck/IncompleteUrlSchemeCheck.go
2026-06-11 07:15:54 +02:00

12 lines
201 B
Go

package main
import "net/url"
func sanitizeUrl(urlstr string) string {
u, err := url.Parse(urlstr)
if err != nil || u.Scheme == "javascript" { // $ Alert
return "about:blank"
}
return urlstr
}