Language: Go
Label: safe
CWE: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.

Code:
func (b *Builder) buildPomeriumHTTPRoutes(
	options *config.Options,
	host string,
	requireStrictTransportSecurity bool,
) ([]*envoy_config_route_v3.Route, error) {
	var routes []*envoy_config_route_v3.Route

	// if this is the pomerium proxy in front of the the authenticate service, don't add
	// these routes since they will be handled by authenticate
	isFrontingAuthenticate, err := isProxyFrontingAuthenticate(options, host)
	if err != nil {
		return nil, err
	}
	if !isFrontingAuthenticate {
		routes = append(routes,
			b.buildControlPlanePathRoute(options, "/ping", requireStrictTransportSecurity),
			b.buildControlPlanePathRoute(options, "/healthz", requireStrictTransportSecurity),
			b.buildControlPlanePathRoute(options, "/.pomerium", requireStrictTransportSecurity),
			b.buildControlPlanePrefixRoute(options, "/.pomerium/", requireStrictTransportSecurity),
			b.buildControlPlanePathRoute(options, "/.well-known/pomerium", requireStrictTransportSecurity),
			b.buildControlPlanePrefixRoute(options, "/.well-known/pomerium/", requireStrictTransportSecurity),
		)
		// per #837, only add robots.txt if there are no unauthenticated routes
		if !hasPublicPolicyMatchingURL(options, url.URL{Scheme: "https", Host: host, Path: "/robots.txt"}) {
			routes = append(routes, b.buildControlPlanePathRoute(options, "/robots.txt", requireStrictTransportSecurity))
		}
	}

	authRoutes, err := b.buildPomeriumAuthenticateHTTPRoutes(options, host, requireStrictTransportSecurity)
	if err != nil {
		return nil, err
	}
	routes = append(routes, authRoutes...)
	return routes, nil
}