File tree Expand file tree Collapse file tree 1 file changed +4
-4
lines changed
javascript/ql/src/Security/CWE-200 Expand file tree Collapse file tree 1 file changed +4
-4
lines changed Original file line number Diff line number Diff line change 7
7
<p >
8
8
Libraries like <code >express</code > provide easy methods for serving entire
9
9
directories of static files from a web server.
10
- However, using these can sometimes lead to accidential information exposure.
10
+ However, using these can sometimes lead to accidental information exposure.
11
11
If for example the <code >node_modules</code > folder is served, then an attacker
12
12
can access the <code >_where</code > field from a <code >package.json</code > file,
13
- which gives the attacker access to the absolute path of the file.
13
+ which gives access to the absolute path of the file.
14
14
</p >
15
15
</overview >
16
16
22
22
23
23
<example >
24
24
<p >
25
- In the example below all the files from the <code >node_modules</code > are served.
25
+ In the example below, all the files from the <code >node_modules</code > are served.
26
26
This allows clients easy access to all files inside that folder, but also allows
27
27
access to potentially private information inside <code >package.json</code > files.
28
28
</p >
29
29
<sample src =" examples/PrivateFileExposure.js" />
30
30
<p >
31
- The issue has been fixed in the below by only serving specific folders within the
31
+ The issue has been fixed below by only serving specific folders within the
32
32
<code >node_modules</code > folder.
33
33
</p >
34
34
<sample src =" examples/PrivateFileExposureFixed.js" />
You can’t perform that action at this time.
0 commit comments