Skip to content

Commit aa991e2

Browse files
committed
Remove unhelpful example
1 parent c651cc3 commit aa991e2

File tree

1 file changed

+0
-29
lines changed

1 file changed

+0
-29
lines changed

go/ql/src/Security/CWE-022/TaintedPathSanitizers.go

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -54,32 +54,3 @@ func handleFileWithSanitizers(w http.ResponseWriter, r *http.Request) {
5454

5555
// Process file...
5656
}
57-
58-
// Example using mime/multipart filename sanitization
59-
func handleUpload(w http.ResponseWriter, r *http.Request) {
60-
err := r.ParseMultipartForm(32 << 20) // 32MB max
61-
if err != nil {
62-
http.Error(w, err.Error(), http.StatusBadRequest)
63-
return
64-
}
65-
66-
file, header, err := r.FormFile("upload")
67-
if err != nil {
68-
http.Error(w, err.Error(), http.StatusBadRequest)
69-
return
70-
}
71-
defer file.Close()
72-
73-
// The Filename field is automatically sanitized by mime/multipart
74-
// using filepath.Base, making it safe from path traversal
75-
filename := header.Filename
76-
77-
// Additional validation can still be useful
78-
if strings.Contains(filename, "..") || strings.ContainsAny(filename, "/\\") {
79-
http.Error(w, "Invalid filename", http.StatusBadRequest)
80-
return
81-
}
82-
83-
// Safe to use filename
84-
_ = filename
85-
}

0 commit comments

Comments
 (0)