mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
18 lines
824 B
TOML
18 lines
824 B
TOML
|
name = "nodegoat"
|
||
|
|
url = "https://github.com/OWASP/NodeGoat.git"
|
||
|
|
commit = "c5cb68a7084e4ae7dcc60e6a98768720a81841e8"
|
||
|
|
language = "javascript"
|
||
|
|
license = "Apache-2.0"
|
||
|
|
license_file = "LICENSE"
|
||
|
|
measures = ["detection"]
|
||
|
|
note = "Express teaching/development transfer input, selected from documented eval injection without scanner results. Not a production holdout. Authored repair and benign variants are in benchmarks/push/inputs.json."
|
||
|
|
[[known]]
|
||
|
|
id = "NodeGoat-contribution-eval"
|
||
|
|
family = "injection"
|
||
|
|
weakness = "Request contribution fields are evaluated as JavaScript before numeric validation."
|
||
|
|
file = "app/routes/contributions.js"
|
||
|
|
function = "handleContributionsUpdate"
|
||
|
|
line = 32
|
||
|
|
reference = "The pinned source documents SSJS injection and an alternate numeric parsing repair immediately below the eval calls."
|
||
|
|
in_scope = true
|