mirror of
https://github.com/github/codeql.git
synced 2026-08-03 17:03:02 +02:00
33 lines
1.0 KiB
Go
33 lines
1.0 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"strings"
|
|
|
|
sq "github.com/Masterminds/squirrel"
|
|
)
|
|
|
|
// Bad because quote characters are removed before concatenation,
|
|
// but then enclosed in a different enclosing quote:
|
|
func mismatch1(id string, version interface{}) {
|
|
versionJSON, _ := json.Marshal(version) // $ Source[go/unsafe-quoting]
|
|
escaped := strings.Replace(string(versionJSON), "\"", "", -1)
|
|
sq.StatementBuilder.
|
|
Insert("resources").
|
|
Columns("resource_id", "version_md5").
|
|
Values(id, sq.Expr("'"+escaped+"'")). // $ Alert[go/unsafe-quoting]
|
|
Exec()
|
|
}
|
|
|
|
// Bad because quote characters are removed before concatenation,
|
|
// but then enclosed in a different enclosing quote:
|
|
func mismatch2(id string, version interface{}) {
|
|
versionJSON, _ := json.Marshal(version) // $ Source[go/unsafe-quoting]
|
|
escaped := strings.Replace(string(versionJSON), "'", "", -1)
|
|
sq.StatementBuilder.
|
|
Insert("resources").
|
|
Columns("resource_id", "version_md5").
|
|
Values(id, sq.Expr("\""+escaped+"\"")). // $ Alert[go/unsafe-quoting]
|
|
Exec()
|
|
}
|