Files
codeql/go/ql/test/query-tests/Security/CWE-078/StoredCommand.go
2026-06-11 07:15:54 +02:00

17 lines
267 B
Go

package main
import (
"database/sql"
"os/exec"
)
var db *sql.DB
func run(query string) {
rows, _ := db.Query(query) // $ Source[go/stored-command]
var cmdName string
rows.Scan(&cmdName)
cmd := exec.Command(cmdName) // $ Alert[go/stored-command]
cmd.Run()
}