Files
codeql/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath-es6.js
2025-02-28 13:29:30 +01:00

11 lines
347 B
JavaScript

import { readFileSync } from 'fs';
import { createServer } from 'http';
import { parse } from 'url';
import { join } from 'path';
var server = createServer(function(req, res) {
let path = parse(req.url, true).query.path; // $ Source
res.write(readFileSync(join("public", path))); // $ Alert - This could read any file on the file system
});