Skip to content

Commit 47bf460

Browse files
fix(security): remediate path traversal vulnerability (S2083) - bug
Co-Authored-By: Joao Esteves <joao.esteves@cognition.ai>
1 parent d240896 commit 47bf460

1 file changed

Lines changed: 8 additions & 2 deletions

File tree

routes/index.js

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,8 +103,14 @@ exports.save_account_details = function(req, res, next) {
103103
profile.firstname = validator.rtrim(profile.firstname)
104104
profile.lastname = validator.rtrim(profile.lastname)
105105

106-
// render the view
107-
return res.render('account.hbs', profile)
106+
// render the view with only the expected properties to prevent path traversal
107+
return res.render('account.hbs', {
108+
email: profile.email,
109+
phone: profile.phone,
110+
firstname: profile.firstname,
111+
lastname: profile.lastname,
112+
country: profile.country
113+
})
108114
} else {
109115
// if input validation fails, we just render the view as is
110116
console.log('error in form details')

0 commit comments

Comments
 (0)