add files uploaded with multer as RemoteFlowSource

2026-04-27 09:45:15 +02:00 · 2021-02-08 20:38:05 +01:00
parent b74911204a
commit e2fbf8a68c
3 changed files with 42 additions and 1 deletions
--- a/javascript/ql/src/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -509,8 +509,9 @@ module Express {
        this = request.getAPropertyRead("cookies")
        or
        // `req.files`, treated the same as `req.body`.
+        // `express-fileupload` uses .files, and `multer` uses .files or .file
        kind = "body" and
-        this = request.getAPropertyRead("files")
+        this = request.getAPropertyRead(["files", "file"])
      )
      or
      kind = "body" and