Sonar ResearchCan you spot the vulnerability? #codeadvent2022 #csharp #appsec
Something was forgotten in this API handler, but what?
https://www.sonarsource.com/knowledge/code-challenges/advent-calendar-2022/?day=3
becojo@SonarResearch The hostname part of the URL does not end with a slash. The appended user input from the `path` parameter can change the domain of the API request which could leak the Authorization environment variable.
The domain github.computer is available and could be reached by the API handler if the `path` parameter is set to "puter".
Louis Dion-Marcil@becojo your brain is too powerful for us mere mortals. great solution!