package main

import (

"database/sql"

"errors"

"fmt"

"net/http"

"os"

"regexp"

)

func good() (interface{}, error) {

name := os.Args[1]

hasBadChar, _ := regexp.MatchString(".*[?].*", name)

if hasBadChar {

return nil, errors.New("bad input")

}

dbDSN := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8", "username", "password", "127.0.0.1", 3306, name)

db, _ := sql.Open("mysql", dbDSN)

return db, nil

}

func bad() interface{} {

name2 := os.Args[1:]

// This is bad. `name` can be something like `test?allowAllFiles=true&` which will allow an attacker to access local files.

dbDSN := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8", "username", "password", "127.0.0.1", 3306, name2[0])

db, _ := sql.Open("mysql", dbDSN)

return db

}

func good2(w http.ResponseWriter, req *http.Request) (interface{}, error) {

name := req.FormValue("name")

hasBadChar, _ := regexp.MatchString(".*[?].*", name)

if hasBadChar {

return nil, errors.New("bad input")

}

dbDSN := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8", "username", "password", "127.0.0.1", 3306, name)

db, _ := sql.Open("mysql", dbDSN)

return db, nil

}

func bad2(w http.ResponseWriter, req *http.Request) interface{} {

name := req.FormValue("name")

// This is bad. `name` can be something like `test?allowAllFiles=true&` which will allow an attacker to access local files.

dbDSN := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8", "username", "password", "127.0.0.1", 3306, name)

db, _ := sql.Open("mysql", dbDSN)

return db

}

type Config struct {

dsn string

}

func NewConfig() *Config { return &Config{dsn: ""} }

func (Config) Parse([]string) error { return nil }

func RegexFuncModelTest(w http.ResponseWriter, req *http.Request) (interface{}, error) {

cfg := NewConfig()

err := cfg.Parse(os.Args[1:]) // This is bad. `name` can be something like `test?allowAllFiles=true&` which will allow an attacker to access local files.

if err != nil {

return nil, err

}

dbDSN := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8", "username", "password", "127.0.0.1", 3306, cfg.dsn)

db, _ := sql.Open("mysql", dbDSN)

return db, nil

}

func main() {

bad2(nil, nil)

good()

bad()

good2(nil, nil)

}