Attack Vulnerabilities

// Vulnerable
const query = `SELECT * FROM users WHERE id = ${userId}`;

// Fixed
const query = `SELECT * FROM users WHERE id = ?`;
db.query(query, [userId]);

// Vulnerable
db.users.find({ user: req.body.user, pass: req.body.pass });

// Fixed - validate input types
const user = String(req.body.user);
const pass = String(req.body.pass);

// Vulnerable
exec(`ping ${userInput}`);

// Fixed - use parameterized APIs
execFile('ping', ['-c', '4', userInput]);

// Vulnerable
eval(userInput);
new Function(userInput)();

// Fixed - avoid eval entirely
JSON.parse(userInput); // for JSON data

# Vulnerable
template.render("Hello " + user_input)

# Fixed
template.render("Hello {{ name }}", name=user_input)

// Vulnerable
element.innerHTML = userInput;

// Fixed
element.textContent = userInput;
// Or use proper sanitization
element.innerHTML = DOMPurify.sanitize(userInput);

// Vulnerable
fetch(userProvidedUrl);

// Fixed - validate against allowlist
const allowed = ['api.example.com'];
const url = new URL(userProvidedUrl);
if (!allowed.includes(url.hostname)) throw new Error('Invalid URL');

// Vulnerable - no CSRF token
app.post('/transfer', (req, res) => { /* ... */ });

// Fixed - verify CSRF token
app.post('/transfer', csrfProtection, (req, res) => { /* ... */ });

// Vulnerable
app.get('/document/:id', (req, res) => {
  return db.documents.findById(req.params.id);
});

// Fixed
app.get('/document/:id', (req, res) => {
  const doc = db.documents.findById(req.params.id);
  if (doc.userId !== req.user.id) return res.status(403);
  return doc;
});

// Vulnerable
const file = path.join('/uploads', userInput);

// Fixed
const file = path.join('/uploads', path.basename(userInput));

// Vulnerable
xmlParser.parse(userXml);

// Fixed - disable external entities
xmlParser.parse(userXml, { noent: false, dtdload: false });

// Vulnerable
res.redirect(req.query.next);

// Fixed
const allowedHosts = ['example.com'];
const url = new URL(req.query.next, 'https://example.com');
if (!allowedHosts.includes(url.hostname)) throw new Error('Invalid redirect');