Express.js: add req.path as remote input source

2026-04-25 16:55:19 +02:00 · 2023-10-31 12:43:30 +01:00
parent 21b7a51d0a
commit 5cc94e1105
2 changed files with 5 additions and 0 deletions
--- a/javascript/ql/lib/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Express.qll
@@ -618,6 +618,10 @@ module Express {
        or
        kind = "body" and
        this = ref.getAPropertyRead("body")
+        or
+        // `req.path`
+        kind = "url" and
+        this = ref.getAPropertyRead("path")
      )
    }