File inclusion injection (ARCH3139)

Key typescript.security.file-inclusion-injection · Severity critical · Category security · CWE CWE-98

Taking the module path to include/load from user input enables local or remote file inclusion and RCE. Map paths through a fixed allowlist.

Incorrect

app.get("/plugin", (req, res) => {
  const mod = require(`./plugins/${req.query.name}`);
  res.json(mod.run());
});

Correct

const plugins: Record<string, () => unknown> = {
  export: () => require("./plugins/export").run(),
  report: () => require("./plugins/report").run(),
};

app.get("/plugin", (req, res) => {
  const run = plugins[String(req.query.name)];
  if (!run) return res.sendStatus(404);
  res.json(run());
});

Fix

Never pass user input into a dynamic require/import; resolve allowed modules through a fixed mapping.