Skip to content

Conversation

@atian25
Copy link
Member

@atian25 atian25 commented Dec 27, 2022

No description provided.

const port = process.env.PORT || 3000;

const app = http.createServer((req, res) => {
console.log(`Receive: ${req.url}`);

Check failure

Code scanning / CodeQL

Log injection

Log entry depends on a [user-provided value](1).
const app = http.createServer((req, res) => {
console.log(`Receive: ${req.url}`);

if (req.url === '/exit') {

Check failure

Code scanning / CodeQL

User-controlled bypass of security check

This condition guards a sensitive [action](1), but a [user-provided value](2) controls it.

rl.question('What is your favorite food? ', (answer) => {
console.log(`Oh, so your favorite food is ${answer}`);
let i = 0;

Check notice

Code scanning / CodeQL

Unused variable, import, function or class

Unused variable i.
this.proc = execa.node(this.cmd, this.args, this.opts);
} else {
const cmdString = [ this.cmd, ...this.args ].join(' ');
this.proc = execa.command(cmdString, this.opts);

Check warning

Code scanning / CodeQL

Shell command built from environment values

This shell command depends on an uncontrolled [absolute path](1). This shell command depends on an uncontrolled [absolute path](2). This shell command depends on an uncontrolled [absolute path](3).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants