Files
codeql/javascript/ql/test/query-tests/Security/CWE-754/UnvalidatedDynamicMethodCall3.js
2022-02-03 09:29:42 +00:00

17 lines
448 B
JavaScript

var express = require('express');
var app = express();
var actions = new Map();
actions.put("play", function play(data) {
// ...
});
actions.put("pause", function pause(data) {
// ...
});
app.get('/perform/:action/:payload', function(req, res) {
if (actions.has(req.params.action)) {
let action = actions.get(req.params.action);
res.end(action(req.params.payload)); // NOT OK, but not flagged [INCONSISTENCY]
}
});