mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
13 lines
404 B
JavaScript
13 lines
404 B
JavaScript
// Split-sink SQL injection: query is built, then executed on the next line.
|
|
const express = require("express");
|
|
const app = express();
|
|
|
|
app.get("/search", (req, res) => {
|
|
const term = req.query.q;
|
|
const query = "select * from items where title like '%" + term + "%'";
|
|
db.query(query); // CWE-89 split-sink: query built on prior line (regex blind spot)
|
|
res.send("ok");
|
|
});
|
|
|
|
module.exports = app;
|