Snowflake Golang Driver vulnerable to Command Injection

@@ -0,0 +1,29 @@
+package gosnowflake
+
+import (
+	"net/url"
+	"regexp"
+)
+
+var (
+	matcher, _ = regexp.Compile(`^http(s?)\:\/\/[0-9a-zA-Z]([-.\w]*[0-9a-zA-Z@:])*(:(0-9)*)*(\/?)([a-zA-Z0-9\-\.\?\,\&\(\)\/\\\+&%\$#_=@]*)?$`)
+)
+
+func isValidURL(targetURL string) bool {
+	if !matcher.MatchString(targetURL) {
+		logger.Infof(" The provided URL is not a valid URL - " + targetURL)
+		return false
+	}
+	return true
+}
+
+func urlEncode(targetString string) string {
+	// We use QueryEscape instead of PathEscape here
+	// for consistency across Drivers. For example:
+	// QueryEscape escapes space as "+" whereas PE
+	// it as %20F. PE also does not escape @ or &
+	// either but QE does.
+	// The behavior of QE in Golang is more in sync
+	// with URL encoders in Python and Java hence the choice
+	return url.QueryEscape(targetString)
+}

@@ -230,3 +230,44 @@ func TestGetMin(t *testing.T) {
 		}
 	}
 }
+
+type tcURLList struct {
+	in  string
+	out bool
+}
+
+func TestValidURL(t *testing.T) {
+	testcases := []tcURLList{
+		{"https://ssoTestURL.okta.com", true},
+		{"https://ssoTestURL.okta.com:8080", true},
+		{"https://ssoTestURL.okta.com/testpathvalue", true},
+		{"-a calculator", false},
+		{"This is a random test", false},
+		{"file://TestForFile", false},
+	}
+	for _, test := range testcases {
+		result := isValidURL(test.in)
+		if test.out != result {
+			t.Errorf("Failed to validate URL, input :%v, expected: %v, got: %v", test.in, test.out, result)
+		}
+	}
+}
+
+type tcEncodeList struct {
+	in  string
+	out string
+}
+
+func TestEncodeURL(t *testing.T) {
+	testcases := []tcEncodeList{
+		{"Hello @World", "Hello+%40World"},
+		{"Test//String", "Test%2F%2FString"},
+	}
+
+	for _, test := range testcases {
+		result := urlEncode(test.in)
+		if test.out != result {
+			t.Errorf("Failed to encode string, input %v, expected: %v, got: %v", test.in, test.out, result)
+		}
+	}
+}