Files
codeql/javascript/ql/test/query-tests/Security/CWE-078/exec-sh2.js
2020-09-23 14:07:36 +01:00

17 lines
351 B
JavaScript

const cp = require('child_process'),
http = require('http'),
url = require('url');
function getShell() {
return "sh";
}
function execSh(command, options) {
return cp.spawn(getShell(), ["-c", command], options) // BAD
};
http.createServer(function (req, res) {
let cmd = url.parse(req.url, true).query.path;
execSh(cmd);
});