Fix the other one

Signed-off-by: Yuri Shkuro <github@ysh.us>
jaegertracing · Dec 20, 2020 · 20d8fee · 20d8fee
1 parent bde9cb8
commit 20d8fee
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/cmd/collector/app/zipkin/http_handler.go b/cmd/collector/app/zipkin/http_handler.go
@@ -18,6 +18,7 @@ package zipkin
 import (
 	"compress/gzip"
 	"fmt"
+	"html"
 	"io"
 	"io/ioutil"
 	"mime"
@@ -100,7 +101,10 @@ func (aH *APIHandler) saveSpans(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if err != nil {
-		http.Error(w, fmt.Sprintf(handler.UnableToReadBodyErrFormat, err), http.StatusBadRequest)
+		// CodeQL seems to produce false-positive vulnerability warning.
+		// https://github.com/github/codeql/issues/4853
+		safeErr := html.EscapeString(err.Error())
+		http.Error(w, fmt.Sprintf(handler.UnableToReadBodyErrFormat, safeErr), http.StatusBadRequest)
 		return
 	}