Files
codeql/javascript/ql/test/query-tests/Security/CWE-522-DecompressionBombs/gunzip-maybe.js
2023-10-06 22:10:57 +02:00

14 lines
429 B
JavaScript

const gunzipmaybe = require("gunzip-maybe");
const express = require('express')
const fileUpload = require("express-fileupload");
const { Readable } = require('stream');
const app = express();
app.use(fileUpload());
app.listen(3000, () => {
});
app.post('/upload', async (req, res) => {
// Unsafe
const RemoteStream = Readable.from(req.files.ZipFile.data);
RemoteStream.pipe(gunzipmaybe).createWriteStream("tmp")
});