Skip to content

New branch sast inline #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

New branch sast inline #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f5899fc
TestPR
IneHerm Feb 18, 2025
a623f43
Create testPR.js
IneHerm Feb 18, 2025
dca55c6
test123
IneHerm Feb 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions TestPR
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
const express = require('express');
const mongoose = require('mongoose');

const app = express();
const port = 3000;

// Connect to MongoDB
mongoose.connect('mongodb://localhost:27017/users_db', {
useNewUrlParser: true,
useUnifiedTopology: true
});

const User = mongoose.model('User', new mongoose.Schema({ username: String, password: String }));

// ⚠️ SAST ISSUE: NoSQL Injection vulnerability ⚠️
app.get('/user', async (req, res) => {
const username = req.query.username; // User-controlled input

// 🚨 UNSAFE: Directly passing user input into MongoDB query 🚨
const user = await User.findOne({ username: username });

if (!user) {
return res.status(404).send('User not found');
}

res.json(user);
});

app.listen(port, () => {
console.log(`Server running on http://localhost:${port}`);
31 changes: 31 additions & 0 deletions test
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
const express = require('express');
const mongoose = require('mongoose');

const app = express();
const port = 3000;

// Connect to MongoDB
mongoose.connect('mongodb://localhost:27017/users_db', {
useNewUrlParser: true,
useUnifiedTopology: true
});

const User = mongoose.model('User', new mongoose.Schema({ username: String, password: String }));

// ⚠️ SAST ISSUE: NoSQL Injection vulnerability ⚠️
app.get('/user', async (req, res) => {
const username = req.query.username; // User-controlled input

// 🚨 UNSAFE: Directly passing user input into MongoDB query 🚨
const user = await User.findOne({ username: username });

if (!user) {
return res.status(404).send('User not found');
}

res.json(user);
});

app.listen(port, () => {
console.log(`Server running on http://localhost:${port}`);
});
31 changes: 31 additions & 0 deletions testPR.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
const express = require('express');
Copy link

@codacy-production codacy-production bot Feb 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❌ Codacy found a critical ErrorProne issue: Require statement not part of import statement.

The issue reported by ESLint indicates that the use of require is not in line with modern JavaScript practices, particularly when using ES6 modules. The linter suggests that you should use the import statement instead of require to import modules, as import is part of the ES6 module syntax which is more aligned with the current standards for JavaScript.

To resolve this issue, you can change the require statement to an import statement. Here's the suggested change:

Suggested change
const express = require('express');
import express from 'express';

This single line change will update the module import to use the ES6 syntax, addressing the ESLint warning. However, please note that if you switch to using import, you may also need to ensure that your environment supports ES modules or configure your project accordingly (e.g., using Babel or setting "type": "module" in your package.json).

This comment was generated by an experimental AI tool.

const mongoose = require('mongoose');
Copy link

@codacy-production codacy-production bot Feb 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❌ Codacy found a critical ErrorProne issue: Require statement not part of import statement.

The issue described by the ESLint linter indicates that the code is using CommonJS syntax (require) for importing modules, while it is recommended to use ES6 module syntax (import). This is a common preference in modern JavaScript development, especially when using tools like Babel or when working with ES modules in Node.js.

To fix this issue, you can change the require statement to an import statement. Here’s the code suggestion:

Suggested change
const mongoose = require('mongoose');
import mongoose from 'mongoose';

This comment was generated by an experimental AI tool.


const app = express();
const port = 3000;

// Connect to MongoDB
mongoose.connect('mongodb://localhost:27017/users_db', {
useNewUrlParser: true,
useUnifiedTopology: true
});

const User = mongoose.model('User', new mongoose.Schema({ username: String, password: String }));

// ⚠️ SAST ISSUE: NoSQL Injection vulnerability ⚠️
app.get('/user', async (req, res) => {
const username = req.query.username; // User-controlled input

// 🚨 UNSAFE: Directly passing user input into MongoDB query 🚨
const user = await User.findOne({ username: username });

Check warning on line 20 in testPR.js

View check run for this annotation

OX Security / ox-security/scan

NoSQL injection vulnerability in JavaScript 

To prevent NoSQL injection vulnerabilities, always sanitize and validate untrusted data before using it to construct queries. Use libraries or frameworks that automatically escape input to prevent NoSQL injection attacks.

if (!user) {
return res.status(404).send('User not found');
}

res.json(user);
});

app.listen(port, () => {
console.log(`Server running on http://localhost:${port}`);
});