Files
codeql/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/tst2.js
2020-10-16 17:32:36 +01:00

25 lines
438 B
JavaScript

var express = require('express');
var app = express();
app.get('/user/:id', function(req, res) {
let { p, q: r } = req.params;
res.send(p); // NOT OK
res.send(r); // NOT OK
});
const aKnownValue = "foo";
app.get('/bar', function(req, res) {
let { p } = req.params;
if (p == aKnownValue)
res.send(p); // OK
res.send(p); // NOT OK
if (p != aKnownValue)
res.send(p); // NOT OK
else
res.send(p); // OK
});