Avoid using unsanitized user input with sendFile

문서 > 코드 분석 > Static Analysis Rules > Avoid using unsanitized user input with sendFile

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: javascript-express/external-filename-upload

Language: JavaScript

Severity: Warning

Category: Security

CWE: 73

Description

Using unsanitized user input in a sendFile method can allow attackers to access unintended resources.

Set the root option directly in your sendFile options will make this rule not report a violation.

Learn More

Express sendFile API reference

Non-Compliant Code Examples

app.post("/upload", (req, res) => {
    res.sendFile(req.params.filename)

    // options passed, but no root set
    res.sendFile(req.params.filename, { maxAge: 0 })

    // options passed, but no root set, and a callback is set
    res.sendFile(req.params.filename, { maxAge: 0 }, (err) => console.log(err))
})

Compliant Code Examples

app.post("/upload", (req, res) => {
    res.sendFile("foo")

    const options = { maxAge: 0, root: path.join(__dirname, "upload") }

    // options with root set
    res.sendFile(req.params.filename, options)
    res.sendFile(req.params.filename, { maxAge: 0, root: path.join(__dirname, "upload") })

    // options with root set (and a callback is set)
    res.sendFile(req.params.filename, options, (err) => console.log(err))
    res.sendFile(req.params.filename, { maxAge: 0, root: path.join(__dirname, "upload") }, (err) => console.log(err))
})