Possible path traversal vulnerability detected. high

Rule ID: javascript_express_path_traversal CWE: CWE 22 Fingerprint: 730d1c5106516470d1853a35c4aca01b_0

Filename: routes/dataErasure.ts:69

Description

Allowing unsanitized user input in path resolution methods means an attacker could gain access to files and folders outside of the intended scope.

Remediations

❌ Avoid wherever possible

✅ Sanitize user input when resolving paths, for example: - Use replace() to mitigate against unwanted patterns in the path (such as \..\..) - Actively guard against paths that end in “%00” (poison NULL byte attacks) - Use path concatenation to ensure the intended scope is respected

const path = require("path");

app.get("/", (req, res) => {
  if (req.params.path.indexOf('\0')) !== -1 {
    // prevent access
  }

  var folder = req.params.path.replace(/^(\.\.(\/|\\|$))+/, '')

  var pathname = path.join("/public/", folder)
  if pathname.indexOf("/public/") !== 0 {
    // prevent access
  }

  path.resolve(pathname)
})

Resources

OWASP path traversal

Possible path traversal vulnerability detected. high

Rule ID: javascript_express_path_traversal CWE: CWE 22 Fingerprint: f0fdc8f875e9b77313305edb186aec62_1

Filename: routes/keyServer.ts:14

Description

Allowing unsanitized user input in path resolution methods means an attacker could gain access to files and folders outside of the intended scope.

Remediations

❌ Avoid wherever possible

✅ Sanitize user input when resolving paths, for example: - Use replace() to mitigate against unwanted patterns in the path (such as \..\..) - Actively guard against paths that end in “%00” (poison NULL byte attacks) - Use path concatenation to ensure the intended scope is respected

const path = require("path");

app.get("/", (req, res) => {
  if (req.params.path.indexOf('\0')) !== -1 {
    // prevent access
  }

  var folder = req.params.path.replace(/^(\.\.(\/|\\|$))+/, '')

  var pathname = path.join("/public/", folder)
  if pathname.indexOf("/public/") !== 0 {
    // prevent access
  }

  path.resolve(pathname)
})

Resources

OWASP path traversal

Possible path traversal vulnerability detected. high

Rule ID: javascript_express_path_traversal CWE: CWE 22 Fingerprint: 51001ae13fdae4f062cec51a842161b2_2

Filename: routes/logfileServer.ts:14

Description

Allowing unsanitized user input in path resolution methods means an attacker could gain access to files and folders outside of the intended scope.

Remediations

❌ Avoid wherever possible

✅ Sanitize user input when resolving paths, for example: - Use replace() to mitigate against unwanted patterns in the path (such as \..\..) - Actively guard against paths that end in “%00” (poison NULL byte attacks) - Use path concatenation to ensure the intended scope is respected

const path = require("path");

app.get("/", (req, res) => {
  if (req.params.path.indexOf('\0')) !== -1 {
    // prevent access
  }

  var folder = req.params.path.replace(/^(\.\.(\/|\\|$))+/, '')

  var pathname = path.join("/public/", folder)
  if pathname.indexOf("/public/") !== 0 {
    // prevent access
  }

  path.resolve(pathname)
})

Resources

OWASP path traversal

Possible path traversal vulnerability detected. high

Rule ID: javascript_express_path_traversal CWE: CWE 22 Fingerprint: a59cb4c55fa6ab0b98f1f061b0262ee1_3

Filename: routes/quarantineServer.ts:14

Description

Allowing unsanitized user input in path resolution methods means an attacker could gain access to files and folders outside of the intended scope.

Remediations

❌ Avoid wherever possible

✅ Sanitize user input when resolving paths, for example: - Use replace() to mitigate against unwanted patterns in the path (such as \..\..) - Actively guard against paths that end in “%00” (poison NULL byte attacks) - Use path concatenation to ensure the intended scope is respected

const path = require("path");

app.get("/", (req, res) => {
  if (req.params.path.indexOf('\0')) !== -1 {
    // prevent access
  }

  var folder = req.params.path.replace(/^(\.\.(\/|\\|$))+/, '')

  var pathname = path.join("/public/", folder)
  if pathname.indexOf("/public/") !== 0 {
    // prevent access
  }

  path.resolve(pathname)
})

Resources

OWASP path traversal

Hardcoded secret detected high

Rule ID: javascript_lang_hardcoded_secret CWE: CWE 798 Fingerprint: d699b64784f6ca1135369f86e4b64ecb_0

Filename: lib/insecurity.ts:43

Description

Code is not a safe place to store secrets, use environment variables instead.

Remediations

  passport.use(new OAuth2Strategy({
      authorizationURL: 'https://www.example.com/oauth2/authorize',
      tokenURL: 'https://www.example.com/oauth2/token',
      clientID:  process.env.CLIENT_ID,
      clientSecret: process.env.CLIENT_SECRET,
      callbackURL: "http://localhost:3000/auth/example/callback"
    },
    function(accessToken, refreshToken, profile, cb) {
      User.findOrCreate({ exampleId: profile.id }, function (err, user) {
        return cb(err, user);
      });
    }
  ));

Resources

OWASP hardcoded passwords

Hardcoded secret detected high

Rule ID: javascript_lang_hardcoded_secret CWE: CWE 798 Fingerprint: d699b64784f6ca1135369f86e4b64ecb_1

Filename: lib/insecurity.ts:166

Description

Code is not a safe place to store secrets, use environment variables instead.

Remediations

  passport.use(new OAuth2Strategy({
      authorizationURL: 'https://www.example.com/oauth2/authorize',
      tokenURL: 'https://www.example.com/oauth2/token',
      clientID:  process.env.CLIENT_ID,
      clientSecret: process.env.CLIENT_SECRET,
      callbackURL: "http://localhost:3000/auth/example/callback"
    },
    function(accessToken, refreshToken, profile, cb) {
      User.findOrCreate({ exampleId: profile.id }, function (err, user) {
        return cb(err, user);
      });
    }
  ));

Resources

OWASP hardcoded passwords

HTTP communication with user-controlled destination detected. high

Rule ID: javascript_lang_http_url_using_user_input CWE: CWE 918 Fingerprint: 8ed612ce6d89f70e214b65244f8793b4_0

Filename: routes/profileImageUrlUpload.ts:22

Description

Applications should not connect to locations formed from user input. This rule checks for URLs containing user-supplied data.

Remediations

❌ Avoid using user input in HTTP URLs:

const response = axios.get(`https://${req.params.host}`)

✅ Use user input indirectly to form a URL:

const hosts = new Map([
  ["option1", "api1.com"],
  ["option2", "api2.com"]
])

const host = hosts.get(req.params.host)
const response = axois.get(`https://${host}`)

Hardcoded JWT secret detected high

Rule ID: javascript_lang_jwt_hardcoded_secret CWE: CWE 798 Fingerprint: 50ebccec98d14333da6adb3b94c79730_0

Filename: lib/insecurity.ts:55

Description

Code is not a secure place to store secrets, use environment variables instead.

Remediations

Use environment variables

  var jwt = require("jsonwebtoken");

  var token = jwt.sign({ foo: "bar" }, process.env.JWT_SECRET);

Resources

OWASP hardcoded passwords

Sensitive data stored in HTML local storage detected. high

Rule ID: javascript_lang_session CWE: CWE 312 Fingerprint: f9657c5f0e228532df66e6987928ea19_0

Filename: frontend/src/app/login/login.component.ts:102

Description

Sensitive data should not be stored in a localStorage session. This policy looks for any sensitive data stored within the localstorage.

Remediations

It’s best to avoid storing sensitive data in localStorage whenever possible. To keep session data safe, use a server-based session storage solution instead.

❌ If you do need do store data in localStorage, avoid including sensitive data:

localStorage.setItem('user', email)

✅ Instead, use a unique identifier:

localStorage.setItem('user', user.uuid)

Resources

OWASP sensitive data exposure

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: 2422999ee983c379479a0d13296d2b45_0

Filename: data/static/codefixes/dbSchemaChallenge_1.ts:5

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: 8014e30891e8e3cb3c4a378fcf1afa38_1

Filename: data/static/codefixes/dbSchemaChallenge_3.ts:11

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: e3d18d5f0ca1f301fa884039dc723bf6_2

Filename: data/static/codefixes/loginAdminChallenge_1.ts:20

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: 4b0883d52334dfd9a4acce2fcf810121_3

Filename: data/static/codefixes/loginBenderChallenge_1.ts:20

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: 4a25d479d29e305cf7b9b7181f917eb8_4

Filename: data/static/codefixes/loginBenderChallenge_4.ts:17

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: df98e54f62e0cc9172446bbd0361c29c_5

Filename: data/static/codefixes/loginJimChallenge_2.ts:17

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: 1b0805db0c0342c03908f442d4972b13_6

Filename: data/static/codefixes/loginJimChallenge_4.ts:20

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: 7e9979f44c0dbd99c76619f48c4245fa_7

Filename: data/static/codefixes/unionSqlInjectionChallenge_1.ts:6

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: d6273bb4e3195d87ba54a7ca10db72be_8

Filename: data/static/codefixes/unionSqlInjectionChallenge_3.ts:10

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: 1c2a6e42ca5adc2c078fee1a7cb1a787_9

Filename: routes/login.ts:36

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

SQL injection vulnerability detected. high

Rule ID: javascript_lang_sql_injection CWE: CWE 89 Fingerprint: 626e8a24818faf605935d6ca0f0f748f_10

Filename: routes/search.ts:23

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: f561fa26365b6c05e91ddc3b18fbed28_0

Filename: data/static/codefixes/accessLogDisclosureChallenge_1_correct.ts:2

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: f561fa26365b6c05e91ddc3b18fbed28_1

Filename: data/static/codefixes/accessLogDisclosureChallenge_1_correct.ts:7

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 7431053925541a9e4feb79b7adbba3a3_2

Filename: data/static/codefixes/accessLogDisclosureChallenge_2.ts:2

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 7431053925541a9e4feb79b7adbba3a3_3

Filename: data/static/codefixes/accessLogDisclosureChallenge_2.ts:7

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 7431053925541a9e4feb79b7adbba3a3_4

Filename: data/static/codefixes/accessLogDisclosureChallenge_2.ts:11

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 1bde540dc2dc7eadc0a5563ef8d50744_5

Filename: data/static/codefixes/accessLogDisclosureChallenge_3.ts:2

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 1bde540dc2dc7eadc0a5563ef8d50744_6

Filename: data/static/codefixes/accessLogDisclosureChallenge_3.ts:7

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 1bde540dc2dc7eadc0a5563ef8d50744_7

Filename: data/static/codefixes/accessLogDisclosureChallenge_3.ts:11

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 87838e0cadbae4b996ea2ba0ce225f2e_8

Filename: data/static/codefixes/accessLogDisclosureChallenge_4.ts:2

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 87838e0cadbae4b996ea2ba0ce225f2e_9

Filename: data/static/codefixes/accessLogDisclosureChallenge_4.ts:7

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: d0c7f09f2c9927118811b6920976dbde_10

Filename: data/static/codefixes/directoryListingChallenge_1_correct.ts:2

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: d0c7f09f2c9927118811b6920976dbde_11

Filename: data/static/codefixes/directoryListingChallenge_1_correct.ts:6

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 84a18ba9c67531b0f1271ecfad9a6522_12

Filename: data/static/codefixes/directoryListingChallenge_2.ts:6

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 84a18ba9c67531b0f1271ecfad9a6522_13

Filename: data/static/codefixes/directoryListingChallenge_2.ts:10

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 8ebcfc95a36b5c20927ea9e466b8715c_14

Filename: data/static/codefixes/directoryListingChallenge_3.ts:2

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 8ebcfc95a36b5c20927ea9e466b8715c_15

Filename: data/static/codefixes/directoryListingChallenge_3.ts:5

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: 8ebcfc95a36b5c20927ea9e466b8715c_16

Filename: data/static/codefixes/directoryListingChallenge_3.ts:9

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: d1d7fd4f95a122aab479067df9323e6c_17

Filename: data/static/codefixes/directoryListingChallenge_4.ts:2

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: d1d7fd4f95a122aab479067df9323e6c_18

Filename: data/static/codefixes/directoryListingChallenge_4.ts:7

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: d1d7fd4f95a122aab479067df9323e6c_19

Filename: data/static/codefixes/directoryListingChallenge_4.ts:11

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: c539465e8119e4d020831d9f6cf0a973_20

Filename: server.ts:241

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: c539465e8119e4d020831d9f6cf0a973_21

Filename: server.ts:246

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

Missing access restriction to directory listing detected. medium

Rule ID: javascript_express_exposed_dir_listing CWE: CWE 548 Fingerprint: c539465e8119e4d020831d9f6cf0a973_22

Filename: server.ts:250

Description

Inappropriate exposure of a directory listing could give attackers access to sensitive data or source code, either directly or through exploitation of an exposed file structure.

Remediations

✅ Restrict access to sensitive directories and files

Resources

Express Serve index middleware

External control of filename or path detected. medium

Rule ID: javascript_express_external_file_upload CWE: CWE 73 Fingerprint: 8643fdcb8411f54a6af5a25deb2da818_0

Filename: routes/keyServer.ts:14

Description

Passing unsanitized user input to the sendFile API is bad practice and can lead to path manipulation, by which attackers can gain access to resources and data outside of the intended scope.

Remediations

✅ Set the root option to be an absolute path to a directory

app.post("/upload", (req, res) => {
  var options = {
    root: path.join(__dirname, "upload")
  }
  res.sendFile(req.params.filename, options)
}

Resources

Express sendFile API reference

External control of filename or path detected. medium

Rule ID: javascript_express_external_file_upload CWE: CWE 73 Fingerprint: caf5b22a357fad021743f7b2b8da54b8_1

Filename: routes/logfileServer.ts:14

Description

Passing unsanitized user input to the sendFile API is bad practice and can lead to path manipulation, by which attackers can gain access to resources and data outside of the intended scope.

Remediations

✅ Set the root option to be an absolute path to a directory

app.post("/upload", (req, res) => {
  var options = {
    root: path.join(__dirname, "upload")
  }
  res.sendFile(req.params.filename, options)
}

Resources

Express sendFile API reference

External control of filename or path detected. medium

Rule ID: javascript_express_external_file_upload CWE: CWE 73 Fingerprint: 684ac0da58fe48421abddc5208554ab4_2

Filename: routes/quarantineServer.ts:14

Description

Passing unsanitized user input to the sendFile API is bad practice and can lead to path manipulation, by which attackers can gain access to resources and data outside of the intended scope.

Remediations

✅ Set the root option to be an absolute path to a directory

app.post("/upload", (req, res) => {
  var options = {
    root: path.join(__dirname, "upload")
  }
  res.sendFile(req.params.filename, options)
}

Resources

Express sendFile API reference

Unrevoked JWT detected. medium

Rule ID: javascript_express_jwt_not_revoked CWE: CWE 525 Fingerprint: d5aa377b45e8572a3f1634b5411f5973_0

Filename: lib/insecurity.ts:53

Description

The best practice caching policy is to revoke JWTs especially when these contain senstitive information.

Remediations

✅ Ensure JWTs are short-lived by revoking them

expressjwt({
  ...
  isRevoked: this.customRevokeCall(),
  ...
})

Resources

ExpressJWT documentation on revoking tokens

Unrevoked JWT detected. medium

Rule ID: javascript_express_jwt_not_revoked CWE: CWE 525 Fingerprint: d5aa377b45e8572a3f1634b5411f5973_1

Filename: lib/insecurity.ts:54

Description

The best practice caching policy is to revoke JWTs especially when these contain senstitive information.

Remediations

✅ Ensure JWTs are short-lived by revoking them

expressjwt({
  ...
  isRevoked: this.customRevokeCall(),
  ...
})

Resources

ExpressJWT documentation on revoking tokens

Manual HTML sanitization detected. medium

Rule ID: javascript_lang_manual_html_sanitization CWE: CWE 79 Fingerprint: 21de2a29f76880dbfbba700acb3cf4b4_0

Filename: data/static/codefixes/redirectChallenge_3.ts:22

Description

Sanitizing HTML manually is error prone and can lead to Cross Site Scripting (XSS) vulnerabilities.

Remediations

❌ Avoid manually escaping HTML:

const sanitizedUserInput = user.Input
  .replaceAll('<', '&lt;')
  .replaceAll('>', '&gt;');
const html = `<strong>${sanitizedUserInput}</strong>`;

✅ Use a HTML sanitization library:

import sanitizeHtml from 'sanitize-html';

const html = sanitizeHtml(`<strong>${user.Input}</strong>`);

Resources

OWASP XSS explained

Manual HTML sanitization detected. medium

Rule ID: javascript_lang_manual_html_sanitization CWE: CWE 79 Fingerprint: d098ec6c1ec482df2422801759454ad2_1

Filename: data/static/codefixes/restfulXssChallenge_2.ts:59

Description

Sanitizing HTML manually is error prone and can lead to Cross Site Scripting (XSS) vulnerabilities.

Remediations

❌ Avoid manually escaping HTML:

const sanitizedUserInput = user.Input
  .replaceAll('<', '&lt;')
  .replaceAll('>', '&gt;');
const html = `<strong>${sanitizedUserInput}</strong>`;

✅ Use a HTML sanitization library:

import sanitizeHtml from 'sanitize-html';

const html = sanitizeHtml(`<strong>${user.Input}</strong>`);

Resources

OWASP XSS explained

Weak encryption library usage detected. medium

Rule ID: javascript_lang_weak_encryption CWE: CWE 327 Fingerprint: ed4a3f1d4ae34d1ec46c133f1f018970_0

Filename: Gruntfile.js:74

Description

Sensitive data should be encrypted with strong encryption algorithms like aes-256-cbc

Remediations

According to OWASP: MD5, RC4, DES, Blowfish, SHA1. 1024-bit RSA or DSA, 160-bit ECDSA (elliptic curves), ⁸⁰⁄₁₁₂-bit 2TDEA (two key triple DES) are considered as weak hash/encryption algorithms and therefore shouldn’t be used.

✅ Use stronger encryption algorithms when storing data.

const crypto = require("crypto");

const key = "secret key";
const encrypted = crypto.createHmac("es-256-cbc", key).update(user.password);

Resources

NodeJS Crypto Module

Weak encryption library usage detected. medium

Rule ID: javascript_lang_weak_encryption CWE: CWE 327 Fingerprint: ebb92933732305def2e9f74a6c806838_1

Filename: lib/insecurity.ts:42

Description

Sensitive data should be encrypted with strong encryption algorithms like aes-256-cbc

Remediations

According to OWASP: MD5, RC4, DES, Blowfish, SHA1. 1024-bit RSA or DSA, 160-bit ECDSA (elliptic curves), ⁸⁰⁄₁₁₂-bit 2TDEA (two key triple DES) are considered as weak hash/encryption algorithms and therefore shouldn’t be used.

✅ Use stronger encryption algorithms when storing data.

const crypto = require("crypto");

const key = "secret key";
const encrypted = crypto.createHmac("es-256-cbc", key).update(user.password);

Resources

NodeJS Crypto Module