sdk/golang/Standard Library/GoNetURL
Standard Library

GoNetURL

net/url package. Parse() returns a *url.URL from a string — source of taint when parsing user-supplied URLs. Used in SSRF detection for URL validation.

3 sanitizers

Sanitizers

.Parse()Sanitizer
#
Signature
Parse(rawURL string) (*URL, error)

Parses raw URL. Sanitizer when result host is validated against allowlist.

.PathEscape()Sanitizer
#
Signature
PathEscape(s string) string

Escapes string for use in URL path segment. Sanitizes path injection.

.QueryEscape()Sanitizer
#
Signature
QueryEscape(s string) string

Escapes string for use in URL query. Sanitizes injection via encoding.

Other Methods

.QueryUnescape()Neutral
#
Signature
QueryUnescape(s string) (string, error)

Decodes percent-encoded string. Returns decoded tainted data.

Fully-Qualified Names

FQNField
net/urlfqns[0]

Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.

Import

go.mod
// standard library — no go.mod entry required
rule.py
from codepathfinder.go_rule import GoNetURL
Next →GoOS