mirror of
https://github.com/github/codeql.git
synced 2025-12-18 18:10:39 +01:00
21 lines
795 B
JavaScript
21 lines
795 B
JavaScript
const express = require('express');
|
|
const libxmljs = require('libxmljs');
|
|
|
|
express().get('/some/path', function (req) {
|
|
// NOT OK: unguarded entity expansion
|
|
libxmljs.parseXml(req.param("some-xml"), { noent: true }); // $ Alert
|
|
});
|
|
|
|
express().post('/some/path', function (req, res) {
|
|
// NOT OK: unguarded entity expansion
|
|
libxmljs.parseXml(req.param("some-xml"), { noent: true }); // $ Alert
|
|
|
|
// NOT OK: unguarded entity expansion
|
|
libxmljs.parseXmlString(req.param("some-xml"), { noent: true }) // $ Alert
|
|
// NOT OK: unguarded entity expansion
|
|
libxmljs.parseXmlString(req.files.products.data.toString('utf8'), { noent: true })// $ Source=files $ Alert=files
|
|
|
|
// OK - no entity expansion
|
|
libxmljs.parseXmlString(req.files.products.data.toString('utf8'), { noent: false })
|
|
});
|