mirror of
https://github.com/github/codeql.git
synced 2025-12-17 09:13:20 +01:00
46 lines
1.7 KiB
JavaScript
46 lines
1.7 KiB
JavaScript
var express = require('express');
|
|
|
|
var app = express();
|
|
|
|
app.get('/some/path', function(req, res) {
|
|
var f = new Function("return wibbles[" + req.param("wobble") + "];"); // $ Alert[js/code-injection]
|
|
require("vm").runInThisContext("return wibbles[" + req.param("wobble") + "];"); // $ Alert[js/code-injection]
|
|
var runC = require("vm").runInNewContext;
|
|
runC("return wibbles[" + req.param("wobble") + "];"); // $ Alert[js/code-injection]
|
|
var vm = require("vm");
|
|
vm.compileFunction(req.param("code_compileFunction")); // $ Alert[js/code-injection]
|
|
var script = new vm.Script(req.param("code_Script")); // $ Alert[js/code-injection]
|
|
var mdl = new vm.SourceTextModule(req.param("code_SourceTextModule")); // $ Alert[js/code-injection]
|
|
vm.runInContext(req.param("code_runInContext"), vm.createContext()); // $ Alert[js/code-injection]
|
|
});
|
|
|
|
const cp = require('child_process');
|
|
app.get('/other/path', function(req, res) {
|
|
const taint = req.param("wobble"); // $ Source[js/code-injection]
|
|
cp.execFileSync('node', ['-e', taint]); // $ Alert[js/code-injection]
|
|
|
|
cp.execFileSync('node', ['-e', `console.log(${JSON.stringify(taint)})`]);
|
|
});
|
|
|
|
const pty = require('node-pty');
|
|
app.get('/terminal', function(req, res) {
|
|
const taint = req.param("wobble"); // $ Source[js/code-injection]
|
|
const shell = pty.spawn('bash', [], {
|
|
name: 'xterm-color',
|
|
cols: 80,
|
|
rows: 30,
|
|
cwd: process.env.HOME,
|
|
env: process.env
|
|
});
|
|
|
|
shell.write(taint); // $ Alert[js/code-injection]
|
|
});
|
|
|
|
require("express-ws")(app);
|
|
|
|
app.ws("/socket-thing/", function (ws, req) {
|
|
ws.on("message", function (msg) { // $ Source[js/code-injection]
|
|
eval(msg); // $ Alert[js/code-injection]
|
|
});
|
|
});
|