Files
codeql/javascript/ql/test/query-tests/Security/CWE-079/promises.js
2018-08-02 17:53:23 +01:00

12 lines
323 B
JavaScript

let express = require('express');
let app = express();
app.get("/some/path", (req, res) => {
new Promise((resolve, reject) => resolve(req.query.data))
.then(x => res.send(x)); // NOT OK
new Promise((resolve, reject) => resolve(req.query.data))
.then(x => escapeHtml(x))
.then(x => res.send(x)); // OK
});