Files
codeql/javascript/ql/test/query-tests/Security/CWE-643/XpathInjectionBad.js
2018-08-02 17:53:23 +01:00

14 lines
390 B
JavaScript

const express = require('express');
const xpath = require('xpath');
const app = express();
app.get('/some/route', function(req, res) {
let userName = req.param("userName");
// BAD: Use user-provided data directly in an XPath expression
let badXPathExpr = xpath.parse("//users/user[login/text()='" + userName + "']/home_dir/text()");
badXPathExpr.select({
node: root
});
});