Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Go: Add an example specific to domain names in missing-regexp-anchor #16220

Merged
merged 2 commits into from May 11, 2024
Merged

Go: Add an example specific to domain names in missing-regexp-anchor #16220

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
811c175
add example for domain names with sub-domains to missing-regexp-anchor
erik-krogh Apr 15, 2024
462e564
apply suggestion from code review
erik-krogh May 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 6 additions & 0 deletions go/ql/src/Security/CWE-020/MissingRegexpAnchor.qhelp
View file
Open in desktop
Expand Up @@ -45,6 +45,12 @@ one of the alternatives. As an example, the regular expression
<code>(^www\.example\.com)|(beta\.example\.com)/</code>, so the second alternative
<code>beta\.example\.com</code> is not anchored at the beginning of the string.
</p>

<p>
When checking for a domain name that may have subdomains, it is important to anchor the regular expression
or ensure that the domain name is prefixed with a dot.
</p>
<sample src="MissingRegexpAnchorGoodDomain.go"/>
</example>

<references>
Expand Down
20 changes: 20 additions & 0 deletions go/ql/src/Security/CWE-020/MissingRegexpAnchorGoodDomain.go
View file
Open in desktop
@@ -0,0 +1,20 @@
package main

import (
"regexp"
)

func checkSubdomain(domain String) {
// Checking strictly that the domain is `example.com`.
re := "^example\\.com$"
if matched, _ := regexp.MatchString(re, domain); matched {
// domain is good.
}

// GOOD: Alternatively, check the domain is `example.com` or a subdomain of `example.com`.
re2 := "(^|\\.)example\\.com$"

if matched, _ := regexp.MatchString(re2, domain); matched {
// domain is good.
}
}