Avoid rendering resource based on unsanitized user input This product is not supported for your selected
Datadog site . (
).
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.
이 규칙을 사용해 보세요 ID: javascript-express/external-resource
Language: JavaScript
Severity: Warning
Category: Security
CWE : 706
Description Rendering resources based on unsanitized user input should be avoided. At a minimum, one should use a safelist to restrict the potential resources that are exposed.
Non-Compliant Code Examples app . get ( "/" , ( req , res ) => {
res . render ( req . body . path )
res . render ( req . cookies . path )
res . render ( req . headers . path )
res . render ( req . params . path )
res . render ( req . query . path )
})
Compliant Code Examples app . get ( "/" , ( req , res ) => {
const path = req . body . path
if ([ "posts" , "pages" ]. includes ( path )) {
return res . render ( ` ${ path } /success` )
}
res . render ( "error-page" )
})
원활한 통합. Datadog Code Security를 경험해 보세요
