hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Use more sensible validator in example.

Browse Source
This commit is contained in:
Max Schaefer
2023-08-18 14:43:57 +01:00
parent 7823ff968c
commit 87364137df
7 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/Security/CWE-601/examples/ServerSideUrlRedirect.js
View File

@@ -1,6 +1,6 @@
const app = require("express")();
app.get('/redirect', function(req, res) {
app.get("/redirect", function (req, res) {
// BAD: a request parameter is incorporated without validation into a URL redirect
res.redirect(req.params["target"]);
res.redirect(req.query["target"]);
});

4
javascript/ql/src/Security/CWE-601/examples/ServerSideUrlRedirectGood.js
View File

@@ -2,9 +2,9 @@ const app = require("express")();
const VALID_REDIRECT = "http://cwe.mitre.org/data/definitions/601.html";
app.get('/redirect', function(req, res) {
app.get("/redirect", function (req, res) {
// GOOD: the request parameter is validated against a known fixed string
let target = req.params["target"]
let target = req.query["target"];
if (VALID_REDIRECT === target) {
res.redirect(target);
} else {

12
javascript/ql/src/Security/CWE-601/examples/ServerSideUrlRedirectGood2.js
View File

@@ -1,15 +1,15 @@
const app = require("express")();
function isLocalUrl(url) {
return url.startsWith("/") && !url.startsWith("//") && !url.startsWith("/\\");
function isRelativePath(path) {
return !/^(\w+:)?[/\\]{2}/.test(path);
}
app.get('/redirect', function(req, res) {
app.get("/redirect", function (req, res) {
// GOOD: check that we don't redirect to a different host
let target = req.params["target"];
if (isLocalUrl(target)) {
let target = req.query["target"];
if (isRelativePath(target)) {
res.redirect(target);
} else {
res.redirect("/");
}
});
});