We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 550c578 commit c7c46eaCopy full SHA for c7c46ea
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js
@@ -36,11 +36,11 @@ var server = http.createServer(function(req, res) {
36
res.write(fs.readFileSync(path)); // GOOD: Path is sanitized
37
38
path = url.parse(req.url, true).query.path;
39
- // BAD: taint is preserved [INCONSISTENCY]
+ // GOOD: basename is safe
40
res.write(fs.readFileSync(pathModule.basename(path)));
41
// BAD: taint is preserved
42
res.write(fs.readFileSync(pathModule.dirname(path)));
43
+ // GOOD: extname is safe
44
res.write(fs.readFileSync(pathModule.extname(path)));
45
46
res.write(fs.readFileSync(pathModule.join(path)));
0 commit comments