mirror of
https://github.com/github/codeql.git
synced 2025-12-17 09:13:20 +01:00
cd2c4d5e3a
This query flags the cookie-parsing middleware in order to consolidate huge numbers of alerts into a single alert, which is more manageable. But simply annotating the cookie-parsing middleware with 'Alert' isn't a very useful, we want to annotate which middlewares are vulnerable.
49 lines
1.3 KiB
JavaScript
49 lines
1.3 KiB
JavaScript
var express = require('express');
|
|
var cookieParser = require('cookie-parser');
|
|
var passport = require('passport');
|
|
|
|
var app = express();
|
|
|
|
app.use(cookieParser()); // $ Alert
|
|
app.use(passport.authorize({ session: true }));
|
|
|
|
app.post('/changeEmail', function (req, res) {
|
|
let newEmail = req.cookies["newEmail"];
|
|
}); // $ RelatedLocation
|
|
|
|
(function () {
|
|
var app = express();
|
|
|
|
app.use(cookieParser()); // $ Alert
|
|
app.use(passport.authorize({ session: true }));
|
|
|
|
const errorCatch = (fn) =>
|
|
(req, res, next) => {
|
|
fn(req, res, next).catch((e) => console.log("Caught " + e));
|
|
};
|
|
|
|
app.post('/changeEmail', errorCatch(async function (req, res) {
|
|
let newEmail = req.cookies["newEmail"];
|
|
})); // $ RelatedLocation
|
|
})
|
|
|
|
(function () {
|
|
var app = express();
|
|
|
|
app.use(cookieParser()); // $ Alert
|
|
app.use(passport.authorize({ session: true }));
|
|
|
|
const errorCatch = (fn) =>
|
|
(req, res, next) => {
|
|
fn.call(this, req, res, next).catch((e) => console.log("Caught " + e));
|
|
};
|
|
|
|
app.post('/changeEmail', errorCatch(async function (req, res) {
|
|
let newEmail = req.cookies["newEmail"];
|
|
})); // $ RelatedLocation
|
|
|
|
app.post('/doLoginStuff', errorCatch(async function (req, res) {
|
|
req.session.user = loginStuff(req);
|
|
})); // $ RelatedLocation
|
|
})
|