Skip to content

Go/CWE-643: XPath Injection Query in Go #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
1 task done
intrigus-lgtm opened this issue Mar 19, 2020 · 3 comments
Closed
1 task done

Go/CWE-643: XPath Injection Query in Go #52

intrigus-lgtm opened this issue Mar 19, 2020 · 3 comments
Labels
All For One Submissions to the All for One, One for All bounty

Comments

@intrigus-lgtm
Copy link
Contributor

intrigus-lgtm commented Mar 19, 2020 •
edited
Loading

CVE ID(s)

  • None

Report

OWASP on XPath Injection:

XPath Injection attacks occur when a web site uses user-supplied information to construct an XPath query for XML data. By sending intentionally malformed information into the web site, an attacker can find out how the XML data is structured, or access data that he may not normally have access to.

github/codeql-go#66

  • Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing
@intrigus-lgtm intrigus-lgtm added the All For One Submissions to the All for One, One for All bounty label Mar 19, 2020
@intrigus-lgtm
Copy link
Contributor Author

PR, that makes the query supported: github/codeql-go#73

@intrigus-lgtm
Copy link
Contributor Author

All merged :)

@xcorail
Copy link
Contributor

xcorail commented Apr 17, 2020

Created Hackerone report 852316 for bounty 212050 : [52] Go/CWE-643: XPath Injection Query in Go 🎉

@xcorail xcorail closed this as completed Apr 17, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
All For One Submissions to the All for One, One for All bounty
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@xcorail @intrigus-lgtm