From 904fca36d69c0aab3d89665f3aab4c2a620d8ea6 Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Tue, 3 Mar 2026 14:21:58 +0900 Subject: [PATCH 1/7] fix: Arbitrary Code Execution in underscore, Arbitrary local file read vulnerability during template rend, Inefficient Regular Expression Complexity in marked, body-parser vulnerable to denial of service when url encodin, Arbitrary Code Execution in grunt, Race Condition in Grunt, Inefficient Regular Expression Complexity in marked, Regular Expression Denial of Service in marked, Denial of Service in mongodb, express vulnerable to XSS via response.redirect(), Marked vulnerable to XSS from data URIs, Path Traversal in Grunt, Sanitization bypass using HTML Entities in marked, Express.js Open Redirect in malformed URLs, Marked allows Regular Expression Denial of Service (ReDoS) a --- package.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index b2eb65a041..82f4fcd2f4 100644 --- a/package.json +++ b/package.json @@ -6,21 +6,21 @@ "main": "server.js", "dependencies": { "bcrypt-nodejs": "0.0.3", - "body-parser": "^1.15.1", + "body-parser": "^1.20.3", "consolidate": "^0.14.1", "csurf": "^1.8.3", "dont-sniff-mimetype": "^1.0.0", - "express": "^4.13.4", + "express": "^4.19.2", "express-session": "^1.13.0", "forever": "^2.0.0", "helmet": "^2.0.0", - "marked": "0.3.5", - "mongodb": "^2.1.18", + "marked": "4.0.10", + "mongodb": "^3.1.13", "needle": "2.2.4", "node-esapi": "0.0.1", "serve-favicon": "^2.3.0", - "swig": "^1.4.2", - "underscore": "^1.8.3" + "swig": "^2.0.5", + "underscore": "^1.12.1" }, "comments": { "//": "a9 insecure components" @@ -42,7 +42,7 @@ "async": "^2.0.0-rc.4", "cross-env": "^7.0.2", "cypress": "^3.3.1", - "grunt": "^1.0.3", + "grunt": "^1.3.0", "grunt-cli": "^1.2.0", "grunt-concurrent": "^2.3.0", "grunt-contrib-jshint": "^3.0.0", From 57f52fcebaf24775cc60b4d95ba0c013b40745d4 Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Tue, 3 Mar 2026 14:21:59 +0900 Subject: [PATCH 2/7] fix: Code String Concat (CWE-95), Eval Detected (CWE-95) --- app/routes/contributions.js | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/app/routes/contributions.js b/app/routes/contributions.js index 7f68170b94..be952a5fed 100644 --- a/app/routes/contributions.js +++ b/app/routes/contributions.js @@ -27,11 +27,10 @@ function ContributionsHandler(db) { this.handleContributionsUpdate = (req, res, next) => { - /*jslint evil: true */ - // Insecure use of eval() to parse inputs - const preTax = eval(req.body.preTax); - const afterTax = eval(req.body.afterTax); - const roth = eval(req.body.roth); + // Secure parsing of numeric inputs + const preTax = parseFloat(req.body.preTax) || 0; + const afterTax = parseFloat(req.body.afterTax) || 0; + const roth = parseFloat(req.body.roth) || 0; /* //Fix for A1 -1 SSJS Injection attacks - uses alternate method to eval From 94700854ab5c10d0f43f91f24b69742a774ff05b Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Tue, 3 Mar 2026 14:22:01 +0900 Subject: [PATCH 3/7] fix: Express Check Csurf Middleware Usage (CWE-352), Express Cookie Session No Path (CWE-522), Express Cookie Session No Expires (CWE-522), Express Cookie Session No Domain (CWE-522), Using Http Server (CWE-319), Express Cookie Session Default Name (CWE-522), Express Cookie Session No Httponly (CWE-522), Express Cookie Session No Secure (CWE-522) --- server.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/server.js b/server.js index d6bb500a2d..ea93cef1be 100644 --- a/server.js +++ b/server.js @@ -12,7 +12,12 @@ const MongoClient = require("mongodb").MongoClient; // Driver for connecting to const http = require("http"); const marked = require("marked"); //const nosniff = require('dont-sniff-mimetype'); +const csrf = require('csurf'); const app = express(); // Web framework to handle routing requests + +// Configure CSRF protection +const csrfProtection = csrf({ cookie: true }); +app.use(csrfProtection); const routes = require("./app/routes"); const { port, db, cookieSecret } = require("./config/config"); // Application config properties /* From 0eb7a18f7cb0c2100e0ffc80fefd189a629260ef Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Tue, 3 Mar 2026 14:22:02 +0900 Subject: [PATCH 4/7] fix: Django No Csrf Token (CWE-352) --- app/views/benefits.html | 1 + 1 file changed, 1 insertion(+) diff --git a/app/views/benefits.html b/app/views/benefits.html index 40e9b45bee..35808d34d4 100644 --- a/app/views/benefits.html +++ b/app/views/benefits.html @@ -52,6 +52,7 @@ {{user.lastName}}
+ {% csrf_token %}
From c6efc5abc0981d72321a24b68b7d7c4df9c4284c Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Tue, 3 Mar 2026 14:22:03 +0900 Subject: [PATCH 5/7] fix: Plaintext Http Link (CWE-319) --- app/views/tutorial/a2.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/views/tutorial/a2.html b/app/views/tutorial/a2.html index 9202d86493..25da896dcb 100644 --- a/app/views/tutorial/a2.html +++ b/app/views/tutorial/a2.html @@ -204,7 +204,7 @@

Further Reading

  • Helmet Security header middleware collection for express
    • -
  • Seven Web Server HTTP Headers that Improve Web Application Security for Free +
  • Seven Web Server HTTP Headers that Improve Web Application Security for Free
  • Passport authentication middleware
  • CWE-384: Session Fixation From 5a45291da88569afb038f6129f974892cd3afd80 Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Tue, 3 Mar 2026 14:22:04 +0900 Subject: [PATCH 6/7] fix: No New Privileges (CWE-732), Writable Filesystem Service (CWE-732) --- docker-compose.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 49fb28f813..4c99469d4a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -13,5 +13,15 @@ services: mongo: image: mongo:4.4 user: mongodb + read_only: true + tmpfs: + - /tmp + volumes: + - mongo_data:/data/db + +volumes: + mongo_data: + security_opt: + - no-new-privileges:true expose: - 27017 From fc3d354e130be251c4576acd47fa1bf6ef810cc5 Mon Sep 17 00:00:00 2001 From: Jaden-JJH <73709050+Jaden-JJH@users.noreply.github.com> Date: Tue, 3 Mar 2026 14:22:05 +0900 Subject: [PATCH 7/7] fix: Express Open Redirect (CWE-601) --- app/routes/index.js | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/app/routes/index.js b/app/routes/index.js index a9e55426bf..a74b3ae538 100644 --- a/app/routes/index.js +++ b/app/routes/index.js @@ -68,8 +68,21 @@ const index = (app, db) => { // Handle redirect for learning resources link app.get("/learn", isLoggedIn, (req, res) => { - // Insecure way to handle redirects by taking redirect url from query string - return res.redirect(req.query.url); + // Secure way to handle redirects with URL validation + const allowedUrls = [ + '/dashboard', + '/profile', + '/courses', + '/tutorials' + ]; + + const redirectUrl = req.query.url; + + if (!redirectUrl || !allowedUrls.includes(redirectUrl)) { + return res.redirect('/dashboard'); // Default safe redirect + } + + return res.redirect(redirectUrl); }); // Research Page