Description
this is security vulnerability, can't say much about what tool we are using to check security issues in our repo. but the tool is showing some issues with HIGH status
security vulnerability
Gin-Gonic Gin contains a reflected file download attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. A remote attacker could leverage this to allow specially crafted files to be downloaded from a trusted domain.
How to reproduce
not sure
Expectations
vulnerability should resolve
Environment
- go version: 1.20
- gin version (or commit ref): 1.19
- operating system: linux we use docker
Comment From: tharun-d
dup of https://github.com/gin-gonic/gin/issues/3555
Comment From: vitordm
any news about that?