mirror of
https://github.com/github/codeql.git
synced 2025-12-17 17:23:36 +01:00
13 lines
405 B
JavaScript
13 lines
405 B
JavaScript
const express = require('express');
|
|
const xpath = require('xpath');
|
|
const app = express();
|
|
|
|
app.get('/some/route', function(req, res) {
|
|
let userName = req.param("userName"); // $ Source
|
|
|
|
let badXPathExpr = xpath.parse("//users/user[login/text()='" + userName + "']/home_dir/text()"); // $ Alert - Use user-provided data directly in an XPath expression
|
|
badXPathExpr.select({
|
|
node: root
|
|
});
|
|
});
|