Add snyk container scan workflow by pwalsh-snyk · Pull Request #147 · dylansnyk/nodejs-goof

pwalsh-snyk · 2025-07-29T21:10:30Z

No description provided.

updates

adding pod

dylansnyk · 2025-07-29T21:10:39Z

⛔ Snyk checks have failed. 5 issues have been found so far.

Icon	Severity	Issues
	Critical	0
	High	5
	Medium	0
	Low	0

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

⛔ code/snyk check is complete. 5 issues have been found. (View Details)

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

dylansnyk · 2025-07-29T21:10:41Z

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

dylansnyk · 2025-07-29T21:10:42Z

⛔ Snyk checks have failed. 6 issues have been found so far.

Icon	Severity	Issues
	Critical	0
	High	6
	Medium	0
	Low	0

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

⛔ code/snyk check is complete. 6 issues have been found. (View Details)

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

dylansnyk · 2025-07-29T21:10:49Z

+    if (err) return res.status(500).send(err);
+
+
+    cp.exec(`node ${uploadPath}`, (error, stdout, stderr) => {


Command Injection

Unsanitized input from an uploaded file flows into child_process.exec, where it is used to build a shell command. This may result in a Command Injection vulnerability.

Line 77 | CWE-78 | Priority score 808 | Learn more about this vulnerability

Data flow: 13 steps

Step 1 - 5

nodejs-goof/app.js

Line 69 in 5eb016e

let uploadedFile = req.files.file;

Step 6 - 10 app.js#L70

Step 11 - 13

nodejs-goof/app.js

Line 77 in 5eb016e

cp.exec(`node ${uploadPath}`, (error, stdout, stderr) => {

⚡ Fix this issue by replying with the following command: @snyk /fix

dylansnyk · 2025-07-29T21:10:50Z

  name: 'connect.sid',
-  cookie: { path: '/' }
-}))
+  cookie: { path: '/', httpOnly: false, secure: false } 


Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Cookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks.

Line 47 | CWE-614 | Priority score 408

Data flow: 2 steps

Step 1 - 2

nodejs-goof/app.js

Line 47 in 5eb016e

cookie: { path: '/', httpOnly: false, secure: false }

⚡ Fix this issue by replying with the following command: @snyk /fix

dylansnyk · 2025-07-29T21:10:50Z

+
+  // **Save the file without validating its type**
+  uploadedFile.mv(uploadPath, function (err) {
+    if (err) return res.status(500).send(err);


Cross-site Scripting (XSS)

Unsanitized input from an uploaded file flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 74 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Data flow: 9 steps

Step 1 - 5

nodejs-goof/app.js

Line 69 in 5eb016e

let uploadedFile = req.files.file;

Step 6 - 7 app.js#L73

Step 8 - 9

nodejs-goof/app.js

Line 74 in 5eb016e

if (err) return res.status(500).send(err);

⚡ Fix this issue by replying with the following command: @snyk /fix

dylansnyk · 2025-07-29T21:10:50Z

+  let username = req.query.username || 'Guest';
+
+
+  res.send(`<h1>Welcome, ${username}</h1><script>alert('XSS!');</script>`);


Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 91 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Data flow: 10 steps

Step 1 - 7

nodejs-goof/app.js

Line 88 in 5eb016e

let username = req.query.username || 'Guest';

Step 8 - 10

nodejs-goof/app.js

Line 91 in 5eb016e

res.send(`<h1>Welcome, ${username}</h1><script>alert('XSS!');</script>`);

⚡ Fix this issue by replying with the following command: @snyk /fix

dylansnyk · 2025-07-29T21:10:50Z

+  let uploadPath = './uploads/' + uploadedFile.name;
+
+  // **Save the file without validating its type**
+  uploadedFile.mv(uploadPath, function (err) {


Path Traversal

Unsanitized input from an uploaded file flows into mv, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to delete arbitrary files.

Line 73 | CWE-23 | Priority score 808 | Learn more about this vulnerability

Data flow: 12 steps

Step 1 - 5

nodejs-goof/app.js

Line 69 in 5eb016e

let uploadedFile = req.files.file;

Step 6 - 10 app.js#L70

Step 11 - 12

nodejs-goof/app.js

Line 73 in 5eb016e

uploadedFile.mv(uploadPath, function (err) {

⚡ Fix this issue by replying with the following command: @snyk /fix

dylansnyk · 2025-07-29T21:10:50Z

+  let url = req.body.url;
+
+
+  require('http').get(url, (response) => {


Server-Side Request Forgery (SSRF)

Unsanitized input from the HTTP request body flows into http.get, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.

Line 105 | CWE-918 | Priority score 808 | Learn more about this vulnerability

Data flow: 7 steps

Step 1 - 5

nodejs-goof/app.js

Line 102 in 5eb016e

let url = req.body.url;

Step 6 - 7

nodejs-goof/app.js

Line 105 in 5eb016e

require('http').get(url, (response) => {

dylansnyk · 2025-07-29T21:10:50Z

+    if (err) return res.status(500).send(err);
+
+
+    cp.exec(`node ${uploadPath}`, (error, stdout, stderr) => {


Command Injection

Unsanitized input from an uploaded file flows into child_process.exec, where it is used to build a shell command. This may result in a Command Injection vulnerability.

Line 77 | CWE-78 | Priority score 808 | Learn more about this vulnerability

Data flow: 13 steps

Step 1 - 5

nodejs-goof/app.js

Line 69 in 5eb016e

let uploadedFile = req.files.file;

Step 6 - 10 app.js#L70

Step 11 - 13

nodejs-goof/app.js

Line 77 in 5eb016e

cp.exec(`node ${uploadPath}`, (error, stdout, stderr) => {

dylansnyk · 2025-07-29T21:10:50Z

+
+  // **Save the file without validating its type**
+  uploadedFile.mv(uploadPath, function (err) {
+    if (err) return res.status(500).send(err);


Cross-site Scripting (XSS)

Unsanitized input from an uploaded file flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 74 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Data flow: 9 steps

Step 1 - 5

nodejs-goof/app.js

Line 69 in 5eb016e

let uploadedFile = req.files.file;

Step 6 - 7 app.js#L73

Step 8 - 9

nodejs-goof/app.js

Line 74 in 5eb016e

if (err) return res.status(500).send(err);

dylansnyk · 2025-07-29T21:10:50Z

+  let username = req.query.username || 'Guest';
+
+
+  res.send(`<h1>Welcome, ${username}</h1><script>alert('XSS!');</script>`);


Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 91 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Data flow: 10 steps

Step 1 - 7

nodejs-goof/app.js

Line 88 in 5eb016e

let username = req.query.username || 'Guest';

Step 8 - 10

nodejs-goof/app.js

Line 91 in 5eb016e

res.send(`<h1>Welcome, ${username}</h1><script>alert('XSS!');</script>`);

dylansnyk · 2025-07-29T21:10:50Z

+  let uploadPath = './uploads/' + uploadedFile.name;
+
+  // **Save the file without validating its type**
+  uploadedFile.mv(uploadPath, function (err) {


Path Traversal

Unsanitized input from an uploaded file flows into mv, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to delete arbitrary files.

Line 73 | CWE-23 | Priority score 808 | Learn more about this vulnerability

Data flow: 12 steps

Step 1 - 5

nodejs-goof/app.js

Line 69 in 5eb016e

let uploadedFile = req.files.file;

Step 6 - 10 app.js#L70

Step 11 - 12

nodejs-goof/app.js

Line 73 in 5eb016e

uploadedFile.mv(uploadPath, function (err) {

dylansnyk · 2025-07-29T21:10:51Z

+  let url = req.body.url;
+
+
+  require('http').get(url, (response) => {


Server-Side Request Forgery (SSRF)

Unsanitized input from the HTTP request body flows into http.get, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.

Line 105 | CWE-918 | Priority score 808 | Learn more about this vulnerability

Data flow: 7 steps

Step 1 - 5

nodejs-goof/app.js

Line 102 in 5eb016e

let url = req.body.url;

Step 6 - 7

nodejs-goof/app.js

Line 105 in 5eb016e

require('http').get(url, (response) => {

pwalsh-snyk added 6 commits March 4, 2025 16:47

updates

95d4ca2

Merge pull request #19 from pwalsh-snyk/demo-testing

b9b4929

updates

adding pod

f99b09a

Merge pull request #27 from pwalsh-snyk/pod-testing.yaml

628eb8c

adding pod

Delete pod-testing.yaml

b3dadb0

Add Snyk container scan workflow

5eb016e

dylansnyk reviewed Jul 29, 2025

View reviewed changes

		if (err) return res.status(500).send(err);


		cp.exec(`node ${uploadPath}`, (error, stdout, stderr) => {

		let username = req.query.username \|\| 'Guest';


		res.send(`<h1>Welcome, ${username}</h1><script>alert('XSS!');</script>`);

		let url = req.body.url;


		require('http').get(url, (response) => {

Conversation

pwalsh-snyk commented Jul 29, 2025

Uh oh!

dylansnyk commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⛔ Snyk checks have failed. 5 issues have been found so far.

Uh oh!

dylansnyk commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎉 Snyk checks have passed. No issues have been found so far.

Uh oh!

dylansnyk commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⛔ Snyk checks have failed. 6 issues have been found so far.

Uh oh!

Choose a reason for hiding this comment

Command Injection

Line 77 | CWE-78 | Priority score 808 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Line 47 | CWE-614 | Priority score 408

Uh oh!

Choose a reason for hiding this comment

Cross-site Scripting (XSS)

Line 74 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

Cross-site Scripting (XSS)

Line 91 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

Path Traversal

Line 73 | CWE-23 | Priority score 808 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

Server-Side Request Forgery (SSRF)

Line 105 | CWE-918 | Priority score 808 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

Command Injection

Line 77 | CWE-78 | Priority score 808 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

Cross-site Scripting (XSS)

Line 74 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

Cross-site Scripting (XSS)

Line 91 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

Path Traversal

Line 73 | CWE-23 | Priority score 808 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

Server-Side Request Forgery (SSRF)

Line 105 | CWE-918 | Priority score 808 | Learn more about this vulnerability

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dylansnyk commented Jul 29, 2025 •

edited

Loading

dylansnyk commented Jul 29, 2025 •

edited

Loading

dylansnyk commented Jul 29, 2025 •

edited

Loading