mirror of
https://github.com/github/codeql.git
synced 2026-04-26 17:25:19 +02:00
JavaScript: Assign FileAccessToHttp and HttpToFileAccess a precision.
They will now be run on LGTM, but their results won't be displayed by default.
This commit is contained in:
@@ -3,6 +3,7 @@
|
||||
* @description Directly sending file data in an outbound network request can indicate unauthorized information disclosure.
|
||||
* @kind path-problem
|
||||
* @problem.severity warning
|
||||
* @precision medium
|
||||
* @id js/file-access-to-http
|
||||
* @tags security
|
||||
* external/cwe/cwe-200
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
* @description Writing user-controlled data directly to the file system allows arbitrary file upload and might indicate a backdoor.
|
||||
* @kind path-problem
|
||||
* @problem.severity warning
|
||||
* @precision medium
|
||||
* @id js/http-to-file-access
|
||||
* @tags security
|
||||
* external/cwe/cwe-912
|
||||
|
||||
Reference in New Issue
Block a user