Affected by GO-2026-4637 and 4 other vulnerabilities

GO-2026-4637: WeKnora has Broken Access Control - Cross-Tenant Data Exposure in github.com/Tencent/WeKnora

GO-2026-4638: WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection in github.com/Tencent/WeKnora

GO-2026-4640: WeKnora has Unauthorized Cross‑Tenant Knowledge Base Cloning in github.com/Tencent/WeKnora

GO-2026-4641: WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool in github.com/Tencent/WeKnora

GO-2026-4643: WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources in github.com/Tencent/WeKnora

embedpolicy

package

v0.8.3 Latest Latest Go to latest Published: Oct 14, 2026 License: Apache-2.0, MIT Imports: 4 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Tencent/WeKnora

Links

Open Source Insights

Documentation ¶

Overview ¶

Package embedpolicy separates browser framing policy from API transport origins.

Index ¶

func Allows(origin string, patterns []string) bool
func FrameAncestors(patterns []string) string
func NormalizeOrigin(raw string) (string, error)
func NormalizePattern(raw string) (string, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Allows ¶

func Allows(origin string, patterns []string) bool

Allows matches an API origin against normalized host patterns.

func FrameAncestors ¶

func FrameAncestors(patterns []string) string

FrameAncestors also permits same-origin management previews. Empty or wholly invalid legacy lists fail closed; invalid strings never reach the CSP header.

func NormalizeOrigin ¶

func NormalizeOrigin(raw string) (string, error)

NormalizeOrigin accepts an HTTP(S) origin, with an optional trailing slash. Reject URL components that cannot appear in an Origin or CSP host source.

func NormalizePattern ¶

func NormalizePattern(raw string) (string, error)

NormalizePattern accepts an exact origin, a subdomain wildcard, or the development wildcard.

Types ¶

This section is empty.

Source Files ¶

View all Source files

origin.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL