mirror of
https://github.com/github/codeql.git
synced 2025-12-17 17:23:36 +01:00
91762ec274
3.5M weekly downloads. Note that we do not treat the first argument as a command-injection sink. While it is possible to inject commands that way, it is more likely to cause false positives where the user input is concatenated with some prefix that makes the opening heuristic decide to treat it as a URL.
36 lines
1.2 KiB
JavaScript
36 lines
1.2 KiB
JavaScript
var http = require("http"),
|
|
url = require("url");
|
|
|
|
var server = http.createServer(function (req, res) {
|
|
let cmd = url.parse(req.url, true).query.path;
|
|
|
|
require("cross-spawn").sync(cmd); // NOT OK
|
|
require("execa").shell(cmd); // NOT OK
|
|
require("execa").shellSync(cmd); // NOT OK
|
|
require("execa").stdout(cmd); // NOT OK
|
|
require("execa").stderr(cmd); // NOT OK
|
|
require("execa").sync(cmd); // NOT OK
|
|
|
|
require("cross-spawn")(cmd); // NOT OK
|
|
require("cross-spawn-async")(cmd); // NOT OK
|
|
require("exec")(cmd); // NOT OK
|
|
require("exec-async")(cmd); // NOT OK
|
|
require("execa")(cmd); // NOT OK
|
|
require("remote-exec")(target, cmd); // NOT OK
|
|
|
|
const ssh2 = require("ssh2");
|
|
new ssh2().exec(cmd); // NOT OK
|
|
new ssh2.Client().exec(cmd); // NOT OK
|
|
|
|
const SSH2Stream = require("ssh2-streams").SSH2Stream;
|
|
new SSH2Stream().exec(false, cmd); // NOT OK
|
|
|
|
require("execa").node(cmd); // NOT OK
|
|
|
|
require("foreground-child")(cmd); // NOT OK
|
|
|
|
const opener = require("opener");
|
|
opener("http://github.com/" + url.parse(req.url, true).query.user); // OK
|
|
opener("http://github.com", { command: cmd }); // NOT OK
|
|
});
|