Files
codeql/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/promises.js
2025-02-28 13:29:30 +01:00

12 lines
330 B
JavaScript

let express = require('express');
let app = express();
app.get("/some/path", (req, res) => {
new Promise((resolve, reject) => resolve(req.query.data)) // $ Source
.then(x => res.send(x)); // $ Alert
new Promise((resolve, reject) => resolve(req.query.data))
.then(x => escapeHtml(x))
.then(x => res.send(x));
});