Files
codeql/javascript/ql/test/query-tests/Security/CWE-400/RemotePropertyInjection/tstNonExpr.js
2025-08-27 10:17:39 +00:00

11 lines
286 B
JavaScript

var http = require('http');
var url = require('url');
var server = http.createServer(function(req, res) {
var userVal = req.url; // $ Source
var newProp = "$" + userVal;
x[newProp] = 23;
res.setHeader(userVal, 'text/html'); // $ Alert
res.write("foo");
res.end("bar");
})