File tree Expand file tree Collapse file tree
javascript/ql/src/Security/CWE-200 Expand file tree Collapse file tree Original file line number Diff line number Diff line change 77 <p >
88 Libraries like <code >express</code > provide easy methods for serving entire
99 directories of static files from a web server.
10- However, using these can sometimes lead to accidential information exposure.
10+ However, using these can sometimes lead to accidental information exposure.
1111 If for example the <code >node_modules</code > folder is served, then an attacker
1212 can access the <code >_where</code > field from a <code >package.json</code > file,
13- which gives the attacker access to the absolute path of the file.
13+ which gives access to the absolute path of the file.
1414 </p >
1515</overview >
1616
2222
2323<example >
2424 <p >
25- In the example below all the files from the <code >node_modules</code > are served.
25+ In the example below, all the files from the <code >node_modules</code > are served.
2626 This allows clients easy access to all files inside that folder, but also allows
2727 access to potentially private information inside <code >package.json</code > files.
2828 </p >
2929 <sample src =" examples/PrivateFileExposure.js" />
3030 <p >
31- The issue has been fixed in the below by only serving specific folders within the
31+ The issue has been fixed below by only serving specific folders within the
3232 <code >node_modules</code > folder.
3333 </p >
3434 <sample src =" examples/PrivateFileExposureFixed.js" />
You can’t perform that action at this time.
0 commit comments