FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Dylan Fixing Issues by DefenderK · Pull Request #202 · DefenderK/nodejs-goof · GitHub

/ nodejs-goof Public
forked from snyk-labs/nodejs-goof

Dylan Fixing Issues - #202

Open
DefenderK wants to merge 1 commit into
mainfrom
demo-branch-20
ConversationCommits (1)ChecksFiles changed
Open

Dylan Fixing Issues#202
DefenderK wants to merge 1 commit into
mainfrom
demo-branch-20

Conversation

DefenderK commented May 16, 2025

Copy link
Copy Markdown
Owner

No description provided.

DefenderK commented May 16, 2025 •
edited
Loading

Copy link
Copy Markdown
Owner Author

⛔ Snyk checks have failed. 2 issues have been found so far.

Icon Severity Issues
Critical 0
High 2
Medium 0
Low 0

⛔ security/snyk check is complete. 1 issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

⛔ code/snyk check is complete. 1 issues have been found. (View Details)

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

DefenderK commented May 16, 2025
View reviewed changes
Comment thread routes/index.js

exports.vulnerable_xss_reflected = function (req, res) {
const userInput = req.query.name;
res.send(`<h1>Hello ${userInput}</h1>`);

DefenderK May 16, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

  Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 326 | CWE-79 | Priority score 806 | Learn more about this vulnerability
Data flow: 8 steps

Step 1 - 5

nodejs-goof/routes/index.js

Line 325 in 5e25e0c

const userInput = req.query.name;

Step 6 - 8

nodejs-goof/routes/index.js

Line 326 in 5e25e0c

res.send(`<h1>Hello ${userInput}</h1>`);

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

Back | FazBrowse Home | New Git URL