mirror of
https://github.com/github/codeql.git
synced 2025-12-17 17:23:36 +01:00
13 lines
350 B
JavaScript
13 lines
350 B
JavaScript
const express = require('express');
|
|
const xpath = require('xpath');
|
|
const app = express();
|
|
|
|
app.get('/some/route', function(req, res) {
|
|
let tainted = req.param("userName");
|
|
xpath.parse(tainted); // NOT OK
|
|
xpath.select(tainted); // NOT OK
|
|
xpath.select1(tainted); // NOT OK
|
|
let expr = xpath.useNamespaces(map);
|
|
expr(tainted); // NOT OK
|
|
});
|