mirror of
https://github.com/github/codeql.git
synced 2025-12-18 01:33:15 +01:00
699d3a0a0a
RegExpInjection does not use client-side sources, but one of its tests was using postMessage events as the taint source. Updating the test to use a different taint source.
8 lines
180 B
JavaScript
8 lines
180 B
JavaScript
const express = require('express');
|
|
const app = express();
|
|
|
|
app.get('/foo', (req, res) => {
|
|
let data = req.query.data;
|
|
new RegExp("^"+ data.name + "$", "i"); // NOT OK
|
|
});
|