commit 232e174a1be5add1a0c4449a7648e92b6e9a1169
Author: Wim <wim@42.be>
Date: Sun Dec 19 14:39:24 2021 +0000
Fix codeql warnings
diff --git a/go.mod b/go.mod
index c17b9a3..3371e9d 100644
--- a/go.mod
+++ b/go.mod
@@ -1217 +1217 @@ require (
go.uber.org/zap v1.17.0 // indirect
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 // indirect
golang.org/x/net v0.0.0-20211006190231-62292e806868 // indirect
- golang.org/x/sys v0.0.0-20211006225509-1a26e0398eed // indirect
+ golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac // indirect
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 // indirect
golang.org/x/text v0.3.7 // indirect
golang.org/x/time v0.0.0-20201208040808-7e3f01d25324 // indirect
diff --git a/hook/rockethook/rockethook.go b/hook/rockethook/rockethook.go
index 1ac8cb0..38f53e4 100644
--- a/hook/rockethook/rockethook.go
+++ b/hook/rockethook/rockethook.go
@@ -76 +77 @@ import (
"log"
"net"
"net/http"
+ "regexp"
)
// Message for rocketchat outgoing webhook.
@@ -687 +696 @@ func (c *Client) ServeHTTP(w http.ResponseWriter, r *http.Request) {
}
msg := Message{}
body, err := ioutil.ReadAll(r.Body)
- log.Println(string(body))
if err != nil {
log.Println(err)
http.NotFound(w, r)
@@ -897 +8911 @@ func (c *Client) ServeHTTP(w http.ResponseWriter, r *http.Request) {
msg.ChannelName = "#" + msg.ChannelName
if c.Token != "" {
if msg.Token != c.Token {
- log.Println("invalid token " + msg.Token + " from " + r.RemoteAddr)
+ if regexp.MustCompile(`[^a-zA-Z0-9]+`).MatchString(msg.Token) {
+ log.Println("invalid token " + msg.Token + " from " + r.RemoteAddr)
+ } else {
+ log.Println("invalid token from " + r.RemoteAddr)
+ }
http.NotFound(w, r)
return
}
