Skip to content

Go: Add Head and Client.Head from net/http as request forgery sinks #20000

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 6 commits into from
Jul 11, 2025
Merged

Go: Add Head and Client.Head from net/http as request forgery sinks #20000

merged 6 commits into from
Jul 11, 2025
+111 −81

Conversation

owen-mc
Copy link
Contributor

@owen-mc owen-mc commented Jul 8, 2025

Added models for the Head function and the Client.Head method, from the net/http package, to the Http::ClientRequest class. This means that they will be recognized as sinks for the query go/request-forgery and the experimental query go/ssrf.

Also tidied up and expanded the tests for go/request-forgery.

@Copilot Copilot AI review requested due to automatic review settings July 8, 2025 15:53
@owen-mc owen-mc requested a review from a team as a code owner July 8, 2025 15:53
@owen-mc owen-mc requested a review from mbg July 8, 2025 15:53
Copilot
Copilot AI reviewed Jul 8, 2025
View reviewed changes
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@owen-mc
Copy link
Contributor Author

owen-mc commented Jul 9, 2025

I ran MRVA on go/request-forgery modified to only use these new sinks. It found one result, in which Get is called right after Head, so it isn't really a new result. Nevertheless I think we should merge these new sinks on principle.

jcogs33
jcogs33 approved these changes Jul 11, 2025
View reviewed changes
Copy link
Contributor

@jcogs33 jcogs33 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks reasonable.

@owen-mc owen-mc merged commit 391e9f7 into github:main Jul 11, 2025
17 checks passed
@owen-mc owen-mc deleted the go/request-forgery branch July 11, 2025 23:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

Copilot code review Copilot Copilot left review comments

@jcogs33 jcogs33 jcogs33 approved these changes

@mbg mbg Awaiting requested review from mbg

Assignees
No one assigned
Labels
documentation Go
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@owen-mc @jcogs33
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy