Cette page n'est pas encore disponible en français, sa traduction est en cours. Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.
Metadata
ID:javascript-express/external-filename-upload
Language: JavaScript
Severity: Warning
Category: Security
Description
Using unsanitized user input in a sendFile method can allow attackers to access unintended resources.
Set the root option directly in your sendFile options will make this rule not report a violation.
app.post("/upload",(req,res)=>{res.sendFile(req.params.filename)// options passed, but no root set
res.sendFile(req.params.filename,{maxAge:0})// options passed, but no root set, and a callback is set
res.sendFile(req.params.filename,{maxAge:0},(err)=>console.log(err))})
Compliant Code Examples
app.post("/upload",(req,res)=>{res.sendFile("foo")constoptions={maxAge:0,root:path.join(__dirname,"upload")}// options with root set
res.sendFile(req.params.filename,options)res.sendFile(req.params.filename,{maxAge:0,root:path.join(__dirname,"upload")})// options with root set (and a callback is set)
res.sendFile(req.params.filename,options,(err)=>console.log(err))res.sendFile(req.params.filename,{maxAge:0,root:path.join(__dirname,"upload")},(err)=>console.log(err))})
Seamless integrations. Try Datadog Code Analysis
Datadog Code Analysis
Try this rule and analyze your code with Datadog Code Analysis
How to use this rule
1
2
rulesets:- javascript-express # Rules to enforce JavaScript express.
Create a static-analysis.datadog.yml with the content above at the root of your repository
Use our free IDE Plugins or add Code Analysis scans to your CI pipelines
