mirror of
https://github.com/github/codeql.git
synced 2025-12-16 16:53:25 +01:00
21 lines
506 B
Go
21 lines
506 B
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
)
|
|
|
|
func serve() {
|
|
http.HandleFunc("/user", func(w http.ResponseWriter, r *http.Request) {
|
|
r.ParseForm()
|
|
username := r.Form.Get("username") // $ Source[go/reflected-xss]
|
|
if !isValidUsername(username) {
|
|
// BAD: a request parameter is incorporated without validation into the response
|
|
fmt.Fprintf(w, "%q is an unknown user", username) // $ Alert[go/reflected-xss]
|
|
} else {
|
|
// TODO: Handle successful login
|
|
}
|
|
})
|
|
http.ListenAndServe(":80", nil)
|
|
}
|