mirror of
https://github.com/github/codeql.git
synced 2025-12-20 18:56:32 +01:00
a8470a984a
In addition to treating comparisons with literals as sanitisers, we now also treat comparisons with variables that have a single assignment as sanitisers. Proving that such a variable is actually a constant is not easy, but for this use case a simple approximation works fine.
25 lines
438 B
JavaScript
25 lines
438 B
JavaScript
var express = require('express');
|
|
|
|
var app = express();
|
|
|
|
app.get('/user/:id', function(req, res) {
|
|
let { p, q: r } = req.params;
|
|
res.send(p); // NOT OK
|
|
res.send(r); // NOT OK
|
|
});
|
|
|
|
const aKnownValue = "foo";
|
|
|
|
app.get('/bar', function(req, res) {
|
|
let { p } = req.params;
|
|
|
|
if (p == aKnownValue)
|
|
res.send(p); // OK
|
|
res.send(p); // NOT OK
|
|
|
|
if (p != aKnownValue)
|
|
res.send(p); // NOT OK
|
|
else
|
|
res.send(p); // OK
|
|
});
|