Description

Detects potential Cross-Site Scripting (XSS) vulnerabilities where file content is directly rendered as HTML through Pug templates without proper sanitization. This creates a risk of executing malicious JavaScript if attackers can control the file content that gets rendered in templates.

Detection Strategy

• Check if the application uses Pug templating engine along with Express.js and file system operations

• Look for Pug template compilation through pug.compile() calls

• Verify file content is being read and passed to compiled templates

• Confirm the rendered template output is sent in HTTP responses

• Exclude cases where DOMPurify sanitization is used in the file

Vulnerable code example

const fs = require('fs');
const config = {
  get: (key) => '../../../etc/passwd' // Simulating malicious config input
};

function readVideoFile() {
  const videoName = config.get('video.name');
  // Vulnerable: Direct path concatenation without sanitization...

✅ Secure code example

const fs = require('fs');
const path = require('path');

const config = {
  get: (key) => '../../../etc/passwd' // Simulating malicious config input
};

function readVideoFile() {...