hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: format qhelp examples

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2019-06-03 17:05:19 +02:00
parent 9e0a97e82f
commit 04868e5b97
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/Security/CWE-020/examples/MissingRegExpAnchor_BAD.js
View File

@@ -1,7 +1,7 @@
app.get('/some/path', function(req, res) {
app.get("/some/path", function(req, res) {
let url = req.param("url");
// BAD: the host of `url` may be controlled by an attacker
if (url.match(/https?:\/\/www\.example\.com\//)) {
if (url.match(/https?:\/\/www\.example\.com\//)) {
res.redirect(url);
}
});

4
javascript/ql/src/Security/CWE-020/examples/MissingRegExpAnchor_GOOD.js
View File

@@ -1,7 +1,7 @@
app.get('/some/path', function(req, res) {
app.get("/some/path", function(req, res) {
let url = req.param("url");
// GOOD: the host of `url` can not be controlled by an attacker
if (url.match(/^https?:\/\/www\.example\.com\//)) {
if (url.match(/^https?:\/\/www\.example\.com\//)) {
res.redirect(url);
}
});