CVE

This query has not been tested against all lgtm projects. So, there is no CVE found using this PR.

Report

This query detects instances where untrusted user input may be used to instantiate a server side connection to an attacker controlled node. This query adds websocket sinks for the following 3rd party libraries.

1. gorilla websocket (11.7k stars)
2. golang/x/net/websocket (2.1k stars)
3. gobwas websocket (3.1k stars)
4. nhooyr.io websocket (1.3k stars)

Apart from these, the initial version of this PR also included support for the net/http standard library's Do/ Get/ Post etc. methods. These were afterwards removed as there was an existing query detecting SSRF which included these sinks.

This query also added checks for three type of sanitizers. All of them based on the OpenURL redirect query.

1. An equality check of the form
   if input == "localhost"{ //sink }
2. A regex check
   if m, _ := regexp.MatchString("ws://localhost:12345/*", untrustedInput); m { // sink }
3. A function of the form isLocalUrl, isValidRedirect.

The now merged PR also include library tests as well as query tests and a qhelp file along with well documented code.

Link to the PR:[github/codeql-go#107]