mirror of
https://github.com/github/codeql.git
synced 2026-04-30 11:15:13 +02:00
JS: recognize Express header access with dynamic name
This commit is contained in:
@@ -483,7 +483,7 @@ module Express {
|
||||
// `req.headers.name`
|
||||
kind = "header" and
|
||||
headers.accesses(request, "headers") and
|
||||
this = headers.getAPropertyRead(_))
|
||||
this = headers.getAPropertyRead())
|
||||
or
|
||||
exists (string propName | propName = "host" or propName = "hostname" |
|
||||
// `req.host` and `req.hostname` are derived from headers
|
||||
|
||||
Reference in New Issue
Block a user