Fix code scanning alert #3: Reflected cross-site scripting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
wavly · Sep 19, 2024 · aca836f · aca836f
1 parent a57dd08
commit aca836f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/handlers/index.go b/handlers/index.go
@@ -5,6 +5,7 @@ import (
     "database/sql"
     "encoding/hex"
     "fmt"
+    "html"
     "log"
     "net/http"
     "strings"
@@ -65,7 +66,7 @@ func Main(w http.ResponseWriter, r *http.Request) {
             }
 
             w.WriteHeader(http.StatusCreated)
-            w.Write([]byte(fmt.Sprintf("Location: /s/%s", customCode)))
+            w.Write([]byte(fmt.Sprintf("Location: /s/%s", html.EscapeString(customCode))))
             return
         }