Skip to content

Commit

Permalink
Add another XSS test
Browse files Browse the repository at this point in the history
  • Loading branch information
picatz committed Sep 16, 2023
1 parent 470dd40 commit e1653cb
Show file tree
Hide file tree
Showing 2 changed files with 41 additions and 0 deletions.
36 changes: 36 additions & 0 deletions xss/testdata/src/e/main.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
package main

import (
"fmt"
"io"
"net/http"
)

func echo(w io.Writer, r any) error {
ior, ok := r.(io.Reader)
if !ok {
return fmt.Errorf("failed to cast to io.Reader")
}

b, err := io.ReadAll(ior)
if err != nil {
return fmt.Errorf("failed to read all bytes from io.Reader: %w", err)
}

w.Write(b)

return nil
}

func handler(w http.ResponseWriter, r *http.Request) {
err := echo(w, r) // want "potential XSS"
if err != nil {
panic(err)
}
}

func main() {
http.HandleFunc("/mirror-safe", handler)

http.ListenAndServe(":8080", nil)
}
5 changes: 5 additions & 0 deletions xss/xss_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -23,3 +23,8 @@ func TestC(t *testing.T) {
func TestD(t *testing.T) {
analysistest.Run(t, testdata, Analyzer, "d")
}

func TestE(t *testing.T) {
analysistest.Run(t, testdata, Analyzer, "e")
}

0 comments on commit e1653cb

Please sign in to comment.