add example for domain names with sub-domains to missing-regexp-anchor

go/ql/src/Security/CWE-020/MissingRegexpAnchor.qhelp

@@ -45,6 +45,12 @@ one of the alternatives. As an example, the regular expression
 <code>(^www\.example\.com)|(beta\.example\.com)/</code>, so the second alternative
 <code>beta\.example\.com</code> is not anchored at the beginning of the string.
 </p>
+
+<p>
+When checking for a domain name with subdomains, it is important to anchor the regular expression
+or ensure that the domain name is prefixed with a dot.
+</p>
+<sample src="MissingRegexpAnchorGoodDomain.go"/>
 </example>
 
 <references>

go/ql/src/Security/CWE-020/MissingRegexpAnchorGoodDomain.go

@@ -0,0 +1,17 @@
+package main
+
+import (
+ "regexp"
+)
+
+func checkSubdomain(domain String) {
+ // GOOD: Checking the domain is `example.com` or a subdomain of `example.com`.
+ re := "(^|\\.)example\\.com$"
+
+ // Alternatively, checking strictly that the domain is `example.com`.
+ // re2 := "^example\\.com$"
+
+ if matched, _ := regexp.MatchString(re, domain); matched {
+ // domain is good.
+ }
+}