File tree Expand file tree Collapse file tree 1 file changed +3
-3
lines changed
javascript/ql/src/Security/CWE-078 Expand file tree Collapse file tree 1 file changed +3
-3
lines changed Original file line number Diff line number Diff line change 66 <p >
77
88 Dynamically constructing a shell command with inputs from exported
9- functions, may inadvertently change the meaning of the shell command.
9+ functions may inadvertently change the meaning of the shell command.
1010
1111 Clients using the exported function may use inputs containing
1212 characters that the shell interprets in a special way, for instance
3737
3838 <p >
3939 The following example shows a dynamically constructed shell
40- command that downloads a file from a remote url .
40+ command that downloads a file from a remote URL .
4141 </p >
4242
4343 <sample src =" examples/unsafe-shell-command-construction.js" />
5050
5151 <p >
5252 Even worse, a client might pass in user-controlled
53- data not knowing that the input is interpreted as a shell command.
53+ data, not knowing that the input is interpreted as a shell command.
5454 This could allow a malicious user to provide the input <code >http://example.org; cat /etc/passwd</code >
5555 in order to execute the command <code >cat /etc/passwd</code >.
5656 </p >
You can’t perform that action at this time.
0 commit comments