> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/4-sast/3-javascript/usage-of-externally-controlled-input-to-select-code.md).

# Usage of externally controlled input to select code

## Overview

* **Rule ID**: `javascript_lang_import_using_user_input`
* **Applicable Languages**: Javascript
* **Weakness ID**: CWE-470

## Description

Loading code dynamically based on a path specified by user input can enable attackers to run arbitrary code on your system.

## Remediation Guidelines

* **Do not pass user or request input directly to the `require()` function.** This can introduce significant security vulnerabilities.
* **Sanitize user input if it is necessary to dynamically load code.** Ensure that the input is thoroughly checked and cleaned to avoid processing malicious data.
* **Adopt a safelist approach when dynamically loading code based on user input.** Confirm that the input matches a predefined list of safe values before proceeding.

  ```java
  var path = req.body.path;
  if (['users', 'posts', 'pages'].includes(path)) {
    require(`${path}.js`);
  }

  ```

## References

* [**CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')**](https://cwe.mitre.org/data/definitions/470.html)
* [**OWASP Top 10: A03:2021 - Injection**](https://owasp.org/Top10/A03_2021-Injection/)

## Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login)