Files
codeql/javascript/ql/test/query-tests/Security/CWE-754/UnvalidatedDynamicMethodCallGood3.js
2025-02-28 13:27:28 +01:00

19 lines
525 B
JavaScript

var express = require('express');
var app = express();
var actions = new Map();
actions.put("play", function play(data) {
// ...
});
actions.put("pause", function pause(data) {
// ...
});
app.get('/perform/:action/:payload', function(req, res) {
let action = actions.get(req.params.action);
if (typeof action === 'function') {
res.end(action(req.params.payload)); // OK - `action` is either the `play` or the `pause` function from above
} else {
res.end("Unsupported action.");
}
});