mirror of
https://github.com/github/codeql.git
synced 2025-12-19 10:23:15 +01:00
6c33013788
Previously it was not possible to associate a ResponseSendArgument with its header definitions if they did not have the same route handler.
But for calls like `new Response(body, { headers })` the headers are fairly obvious whereas the route handler is unnecessarily hard to find. So we use the direct and obvious association between 'body' and 'headers' in the call.
40 lines
1.4 KiB
JavaScript
40 lines
1.4 KiB
JavaScript
const express = require('express');
|
|
|
|
// Note: We're using using express for the taint source in order to to test 'Response'
|
|
// in isolation from the more complicated http frameworks.
|
|
|
|
express().get('/foo', (req) => {
|
|
const data = req.body; // $ Source
|
|
|
|
new Response(data); // $ Alert
|
|
new Response(data, {}); // $ Alert
|
|
new Response(data, { headers: null }); // $ Alert
|
|
|
|
new Response(data, { headers: { 'content-type': 'text/plain'}});
|
|
new Response(data, { headers: { 'content-type': 'text/html'}}); // $ Alert
|
|
|
|
new Response(data, { headers: { 'Content-Type': 'text/plain'}});
|
|
new Response(data, { headers: { 'Content-Type': 'text/html'}}); // $ Alert
|
|
|
|
const headers1 = new Headers({ 'content-type': 'text/plain'});
|
|
new Response(data, { headers: headers1 });
|
|
|
|
const headers2 = new Headers({ 'content-type': 'text/html'});
|
|
new Response(data, { headers: headers2 }); // $ Alert
|
|
|
|
const headers3 = new Headers();
|
|
new Response(data, { headers: headers3 }); // $ Alert
|
|
|
|
const headers4 = new Headers();
|
|
headers4.set('content-type', 'text/plain');
|
|
new Response(data, { headers: headers4 });
|
|
|
|
const headers5 = new Headers();
|
|
headers5.set('content-type', 'text/html');
|
|
new Response(data, { headers: headers5 }); // $ Alert
|
|
|
|
const headers6 = new Headers();
|
|
headers6.set('unrelated-header', 'text/plain');
|
|
new Response(data, { headers: headers6 }); // $ Alert
|
|
});
|