Language: Go
Label: vulnerable
CWE: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Code:
func NewDriver(nodeID, endpoint string, client client.Client, apiReader client.Reader) *driver {
	glog.Infof("Driver: %v version: %v", driverName, version)

	proto, addr := utils.SplitSchemaAddr(endpoint)
	glog.Infof("protocol: %v addr: %v", proto, addr)

	if !strings.HasPrefix(addr, "/") {
		addr = fmt.Sprintf("/%s", addr)
	}

	socketDir := filepath.Dir(addr)
	err := os.MkdirAll(socketDir, 0755)
	if err != nil {
		glog.Errorf("failed due to %v", err)
		os.Exit(1)
	}

	csiDriver := csicommon.NewCSIDriver(driverName, version, nodeID)
	csiDriver.AddControllerServiceCapabilities([]csi.ControllerServiceCapability_RPC_Type{csi.ControllerServiceCapability_RPC_CREATE_DELETE_VOLUME})
	csiDriver.AddVolumeCapabilityAccessModes([]csi.VolumeCapability_AccessMode_Mode{csi.VolumeCapability_AccessMode_MULTI_NODE_MULTI_WRITER})

	return &driver{
		nodeId:    nodeID,
		endpoint:  endpoint,
		csiDriver: csiDriver,
		client:    client,
		apiReader: apiReader,
	}
}