Skip to content

Commit f03c672

Browse files
erik-krogherik-krogh
committed
add taint step for replace call that only removes dots
1 parent 95819c8 commit f03c672

File tree

4 files changed

+206
-4
lines changed

4 files changed

+206
-4
lines changed

‎javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,15 @@ module TaintedPath {
197197
srclabel = dstlabel
198198
)
199199
or
200+
// foo.replace(/\./, "") and similar
201+
exists(DotRemovingReplaceCall call |
202+
src = call.getInput() and
203+
dst = call.getOutput() and
204+
srclabel.isAbsolute() and
205+
dstlabel.isAbsolute() and
206+
dstlabel.isNormalized()
207+
)
208+
or
200209
// path.join()
201210
exists(DataFlow::CallNode join, int n |
202211
join = NodeJSLib::Path::moduleMember("join").getACall()

‎javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,39 @@ module TaintedPath {
239239
DataFlow::Node getOutput() { result = output }
240240
}
241241

242+
/**
243+
* A call that removes all "." or ".." from a path, without also removing all forward slashes.
244+
*/
245+
class DotRemovingReplaceCall extends DataFlow::CallNode {
246+
DataFlow::Node input;
247+
DataFlow::Node output;
248+
249+
DotRemovingReplaceCall() {
250+
this.getCalleeName() = "replace" and
251+
input = getReceiver() and
252+
output = this and
253+
exists(RegExpLiteral literal, RegExpTerm term |
254+
getArgument(0).getALocalSource().asExpr() = literal and
255+
literal.isGlobal() and
256+
literal.getRoot() = term and
257+
not term.getAMatchedString() = "/"
258+
|
259+
term.getAMatchedString() = "." or
260+
term.getAMatchedString() = ".."
261+
)
262+
}
263+
264+
/**
265+
* Gets the input path to be normalized.
266+
*/
267+
DataFlow::Node getInput() { result = input }
268+
269+
/**
270+
* Gets the normalized path.
271+
*/
272+
DataFlow::Node getOutput() { result = output }
273+
}
274+
242275
/**
243276
* Holds if `node` is a prefix of the string `../`.
244277
*/

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1225,6 +1225,58 @@ nodes
12251225
| TaintedPath.js:177:29:177:55 | path.re ... /g, '') |
12261226
| TaintedPath.js:177:29:177:55 | path.re ... /g, '') |
12271227
| TaintedPath.js:177:29:177:55 | path.re ... /g, '') |
1228+
| TaintedPath.js:183:29:183:32 | path |
1229+
| TaintedPath.js:183:29:183:32 | path |
1230+
| TaintedPath.js:183:29:183:32 | path |
1231+
| TaintedPath.js:183:29:183:32 | path |
1232+
| TaintedPath.js:183:29:183:32 | path |
1233+
| TaintedPath.js:183:29:183:32 | path |
1234+
| TaintedPath.js:183:29:183:32 | path |
1235+
| TaintedPath.js:183:29:183:32 | path |
1236+
| TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
1237+
| TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
1238+
| TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
1239+
| TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
1240+
| TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
1241+
| TaintedPath.js:184:29:184:32 | path |
1242+
| TaintedPath.js:184:29:184:32 | path |
1243+
| TaintedPath.js:184:29:184:32 | path |
1244+
| TaintedPath.js:184:29:184:32 | path |
1245+
| TaintedPath.js:184:29:184:32 | path |
1246+
| TaintedPath.js:184:29:184:32 | path |
1247+
| TaintedPath.js:184:29:184:32 | path |
1248+
| TaintedPath.js:184:29:184:32 | path |
1249+
| TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
1250+
| TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
1251+
| TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
1252+
| TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
1253+
| TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
1254+
| TaintedPath.js:185:29:185:32 | path |
1255+
| TaintedPath.js:185:29:185:32 | path |
1256+
| TaintedPath.js:185:29:185:32 | path |
1257+
| TaintedPath.js:185:29:185:32 | path |
1258+
| TaintedPath.js:185:29:185:32 | path |
1259+
| TaintedPath.js:185:29:185:32 | path |
1260+
| TaintedPath.js:185:29:185:32 | path |
1261+
| TaintedPath.js:185:29:185:32 | path |
1262+
| TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
1263+
| TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
1264+
| TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
1265+
| TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
1266+
| TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
1267+
| TaintedPath.js:186:29:186:32 | path |
1268+
| TaintedPath.js:186:29:186:32 | path |
1269+
| TaintedPath.js:186:29:186:32 | path |
1270+
| TaintedPath.js:186:29:186:32 | path |
1271+
| TaintedPath.js:186:29:186:32 | path |
1272+
| TaintedPath.js:186:29:186:32 | path |
1273+
| TaintedPath.js:186:29:186:32 | path |
1274+
| TaintedPath.js:186:29:186:32 | path |
1275+
| TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
1276+
| TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
1277+
| TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
1278+
| TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
1279+
| TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
12281280
| normalizedPaths.js:11:7:11:27 | path |
12291281
| normalizedPaths.js:11:7:11:27 | path |
12301282
| normalizedPaths.js:11:7:11:27 | path |
@@ -4069,6 +4121,38 @@ edges
40694121
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:177:29:177:32 | path |
40704122
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:177:29:177:32 | path |
40714123
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:177:29:177:32 | path |
4124+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:183:29:183:32 | path |
4125+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:183:29:183:32 | path |
4126+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:183:29:183:32 | path |
4127+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:183:29:183:32 | path |
4128+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:183:29:183:32 | path |
4129+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:183:29:183:32 | path |
4130+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:183:29:183:32 | path |
4131+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:183:29:183:32 | path |
4132+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:184:29:184:32 | path |
4133+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:184:29:184:32 | path |
4134+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:184:29:184:32 | path |
4135+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:184:29:184:32 | path |
4136+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:184:29:184:32 | path |
4137+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:184:29:184:32 | path |
4138+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:184:29:184:32 | path |
4139+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:184:29:184:32 | path |
4140+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:185:29:185:32 | path |
4141+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:185:29:185:32 | path |
4142+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:185:29:185:32 | path |
4143+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:185:29:185:32 | path |
4144+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:185:29:185:32 | path |
4145+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:185:29:185:32 | path |
4146+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:185:29:185:32 | path |
4147+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:185:29:185:32 | path |
4148+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:186:29:186:32 | path |
4149+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:186:29:186:32 | path |
4150+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:186:29:186:32 | path |
4151+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:186:29:186:32 | path |
4152+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:186:29:186:32 | path |
4153+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:186:29:186:32 | path |
4154+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:186:29:186:32 | path |
4155+
| TaintedPath.js:173:7:173:48 | path | TaintedPath.js:186:29:186:32 | path |
40724156
| TaintedPath.js:173:14:173:37 | url.par ... , true) | TaintedPath.js:173:14:173:43 | url.par ... ).query |
40734157
| TaintedPath.js:173:14:173:37 | url.par ... , true) | TaintedPath.js:173:14:173:43 | url.par ... ).query |
40744158
| TaintedPath.js:173:14:173:37 | url.par ... , true) | TaintedPath.js:173:14:173:43 | url.par ... ).query |
@@ -4181,6 +4265,70 @@ edges
41814265
| TaintedPath.js:177:29:177:32 | path | TaintedPath.js:177:29:177:55 | path.re ... /g, '') |
41824266
| TaintedPath.js:177:29:177:32 | path | TaintedPath.js:177:29:177:55 | path.re ... /g, '') |
41834267
| TaintedPath.js:177:29:177:32 | path | TaintedPath.js:177:29:177:55 | path.re ... /g, '') |
4268+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4269+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4270+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4271+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4272+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4273+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4274+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4275+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4276+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4277+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4278+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4279+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4280+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4281+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4282+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4283+
| TaintedPath.js:183:29:183:32 | path | TaintedPath.js:183:29:183:52 | path.re ... /g, '') |
4284+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4285+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4286+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4287+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4288+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4289+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4290+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4291+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4292+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4293+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4294+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4295+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4296+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4297+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4298+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4299+
| TaintedPath.js:184:29:184:32 | path | TaintedPath.js:184:29:184:53 | path.re ... /g, '') |
4300+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4301+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4302+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4303+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4304+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4305+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4306+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4307+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4308+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4309+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4310+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4311+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4312+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4313+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4314+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4315+
| TaintedPath.js:185:29:185:32 | path | TaintedPath.js:185:29:185:51 | path.re ... /g, '') |
4316+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4317+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4318+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4319+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4320+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4321+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4322+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4323+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4324+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4325+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4326+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4327+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4328+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4329+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4330+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
4331+
| TaintedPath.js:186:29:186:32 | path | TaintedPath.js:186:29:186:57 | path.re ... /g, '') |
41844332
| normalizedPaths.js:11:7:11:27 | path | normalizedPaths.js:13:19:13:22 | path |
41854333
| normalizedPaths.js:11:7:11:27 | path | normalizedPaths.js:13:19:13:22 | path |
41864334
| normalizedPaths.js:11:7:11:27 | path | normalizedPaths.js:13:19:13:22 | path |
@@ -5640,6 +5788,10 @@ edges
56405788
| TaintedPath.js:166:19:166:38 | concatted2.join("/") | TaintedPath.js:149:24:149:30 | req.url | TaintedPath.js:166:19:166:38 | concatted2.join("/") | This path depends on $@. | TaintedPath.js:149:24:149:30 | req.url | a user-provided value |
56415789
| TaintedPath.js:168:19:168:29 | split.pop() | TaintedPath.js:149:24:149:30 | req.url | TaintedPath.js:168:19:168:29 | split.pop() | This path depends on $@. | TaintedPath.js:149:24:149:30 | req.url | a user-provided value |
56425790
| TaintedPath.js:177:29:177:55 | path.re ... /g, '') | TaintedPath.js:173:24:173:30 | req.url | TaintedPath.js:177:29:177:55 | path.re ... /g, '') | This path depends on $@. | TaintedPath.js:173:24:173:30 | req.url | a user-provided value |
5791+
| TaintedPath.js:183:29:183:52 | path.re ... /g, '') | TaintedPath.js:173:24:173:30 | req.url | TaintedPath.js:183:29:183:52 | path.re ... /g, '') | This path depends on $@. | TaintedPath.js:173:24:173:30 | req.url | a user-provided value |
5792+
| TaintedPath.js:184:29:184:53 | path.re ... /g, '') | TaintedPath.js:173:24:173:30 | req.url | TaintedPath.js:184:29:184:53 | path.re ... /g, '') | This path depends on $@. | TaintedPath.js:173:24:173:30 | req.url | a user-provided value |
5793+
| TaintedPath.js:185:29:185:51 | path.re ... /g, '') | TaintedPath.js:173:24:173:30 | req.url | TaintedPath.js:185:29:185:51 | path.re ... /g, '') | This path depends on $@. | TaintedPath.js:173:24:173:30 | req.url | a user-provided value |
5794+
| TaintedPath.js:186:29:186:57 | path.re ... /g, '') | TaintedPath.js:173:24:173:30 | req.url | TaintedPath.js:186:29:186:57 | path.re ... /g, '') | This path depends on $@. | TaintedPath.js:173:24:173:30 | req.url | a user-provided value |
56435795
| normalizedPaths.js:13:19:13:22 | path | normalizedPaths.js:11:14:11:27 | req.query.path | normalizedPaths.js:13:19:13:22 | path | This path depends on $@. | normalizedPaths.js:11:14:11:27 | req.query.path | a user-provided value |
56445796
| normalizedPaths.js:14:19:14:29 | './' + path | normalizedPaths.js:11:14:11:27 | req.query.path | normalizedPaths.js:14:19:14:29 | './' + path | This path depends on $@. | normalizedPaths.js:11:14:11:27 | req.query.path | a user-provided value |
56455797
| normalizedPaths.js:15:19:15:38 | path + '/index.html' | normalizedPaths.js:11:14:11:27 | req.query.path | normalizedPaths.js:15:19:15:38 | path + '/index.html' | This path depends on $@. | normalizedPaths.js:11:14:11:27 | req.query.path | a user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -175,12 +175,20 @@ var server = http.createServer(function(req, res) {
175175
// Removal of forward-slash or dots.
176176
res.write(fs.readFileSync(path.replace(/[\]\[*,;'"`<>\\?\/]/g, ''))); // OK.
177177
res.write(fs.readFileSync(path.replace(/[abcd]/g, ''))); // NOT OK
178-
res.write(fs.readFileSync(path.replace(/[.]/g, ''))); // OK (can still be absolute)
179-
res.write(fs.readFileSync(path.replace(/[..]/g, ''))); // OK
180178
res.write(fs.readFileSync(path.replace(/[./]/g, ''))); // OK
181179
res.write(fs.readFileSync(path.replace(/[foobar/foobar]/g, ''))); // OK
182180
res.write(fs.readFileSync(path.replace(/\//g, ''))); // OK
183-
res.write(fs.readFileSync(path.replace(/\./g, ''))); // OK
184181
res.write(fs.readFileSync(path.replace(/\.|\//g, ''))); // OK
185-
res.write(fs.readFileSync(path.replace(/\.\.|BLA/g, ''))); // OK
182+
183+
res.write(fs.readFileSync(path.replace(/[.]/g, ''))); // NOT OK (can be absolute)
184+
res.write(fs.readFileSync(path.replace(/[..]/g, ''))); // NOT OK (can be absolute)
185+
res.write(fs.readFileSync(path.replace(/\./g, ''))); // NOT OK (can be absolute)
186+
res.write(fs.readFileSync(path.replace(/\.\.|BLA/g, ''))); // NOT OK (can be absolute)
187+
188+
if (!pathModule.isAbsolute(path)) {
189+
res.write(fs.readFileSync(path.replace(/[.]/g, ''))); // OK
190+
res.write(fs.readFileSync(path.replace(/[..]/g, ''))); // OK
191+
res.write(fs.readFileSync(path.replace(/\./g, ''))); // OK
192+
res.write(fs.readFileSync(path.replace(/\.\.|BLA/g, ''))); // OK
193+
}
186194
});

0 commit comments

Comments
 (0)