Module TaintedPath

Holds if there is a step src -> dst mapping srclabel to dstlabel relevant for path traversal vulnerabilities.

Holds if s is a relative path.

A templateUrl member of an AngularJS directive.

A barrier guard for tainted-path vulnerabilities.

An expression of form x.matches(/\.\./) or similar.

An expression of form x.includes("..") or similar.

A call that removes all instances of “../” in the prefix of the string.

A call that removes all “.” or “..” from a path, without also removing all forward slashes.

A path argument to the Express res.render method.

A path argument to a file system access.

A call to path.isAbsolute as a sanitizer for relative paths in true branch, and a sanitizer for absolute paths in the false branch.

An expression of form isInside(x, y) or similar, where isInside is a library check for the relation between x and y.

A check of the form whitelist.includes(x) or equivalent, which sanitizes x in its “then” branch.

An expression whose value is interpreted as a path to a module, making it a data flow sink for tainted-path vulnerabilities.

A call that normalizes a path.

A call that normalizes a path and converts it to a relative path.

A call that preserves taint without changing the flow label.

A sanitizer that recognizes the following pattern: var relative = path.relative(webroot, pathname); if(relative.startsWith(".." + path.sep) || relative == "..") { // pathname is unsafe } else { // pathname is safe }

A source of remote user input, considered as a flow source for tainted-path vulnerabilities.

An expression whose value is resolved to a module using the resolve library.

A call that converts a path to an absolute normalized path.

A sanitizer for tainted-path vulnerabilities.

The path argument of a send call, viewed as a sink.

A data flow sink for tainted-path vulnerabilities.

A data flow source for tainted-path vulnerabilities.

A check of form x.startsWith(dir) that sanitizes normalized absolute paths, since it is then known to be in a subdirectory of dir.

A check of form x.startsWith("../") or similar.