Files
codeql/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/tainted-promise-steps.js
2023-10-13 13:15:03 +02:00

16 lines
385 B
JavaScript

var fs = require('fs'),
http = require('http'),
url = require('url');
var server = http.createServer(function(req, res) {
let path = url.parse(req.url, true).query.path;
doRead(Promise.resolve(path));
});
async function doRead(pathPromise) {
fs.readFileSync(await pathPromise); // NOT OK
pathPromise.then(path => fs.readFileSync(path)); // NO TOK
}
server.listen();