Description
github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
huandu facebook
<= 2.7.1affected
References
- https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr ↗
- https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4 ↗
- https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633 ↗
- https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30 ↗
- https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567 ↗