Adding login endpoint #2
Conversation
Mayhem for API Automated API Testing Report❗ 1 Errors Found
✔️ 🎆 0 Warnings FoundTesting details and issue reproduction found at https://app.mayhem.security/forallsecure-demo/mapi-node-example/node/27 |
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## main #2 +/- ##
==========================================
- Coverage 88.23% 81.57% -6.66%
==========================================
Files 1 1
Lines 17 38 +21
==========================================
+ Hits 15 31 +16
- Misses 2 7 +5
Flags with carried forward coverage won't be shown. Click here to find out more.
☔ View full report in Codecov by Sentry. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| db.get(query, [], (err, row) => { | ||
| if (err) { | ||
| return res.status(500).send(`{"error": "${err.stack}"}`); |
Check warning
Code scanning / CodeQL
Exception text reinterpreted as HTML
| app.get('/login', (req, res) => { | ||
| const { email, password } = req.query; | ||
|
|
||
| if (!email || !password) { | ||
| return res.status(400).send('Email and password are required'); | ||
| } | ||
| const query = `SELECT * FROM users WHERE email = '${email}' and password = '${password}'`; | ||
|
|
||
| db.get(query, [], (err, row) => { | ||
| if (err) { | ||
| return res.status(500).send(`{"error": "${err.stack}"}`); | ||
| } | ||
| return res.send('Login successful'); | ||
| }); | ||
| }); |
Check failure
Code scanning / CodeQL
Missing rate limiting
|
|
||
| // Login endpoint (Unsafe) | ||
| app.get('/login', (req, res) => { | ||
| const { email, password } = req.query; |
Check warning
Code scanning / CodeQL
Sensitive data read from GET request
| } | ||
| const query = `SELECT * FROM users WHERE email = '${email}' and password = '${password}'`; | ||
|
|
||
| db.get(query, [], (err, row) => { |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources
| const attachmentPath = path.join(__dirname, 'attachments', attachmentName); | ||
|
|
||
| // Check if file exists | ||
| if (!fs.existsSync(attachmentPath)) { |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression
| } | ||
|
|
||
| // Read the file and send it in the response | ||
| fs.readFile(attachmentPath, (err, data) => { |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression
| app.get('/attachment/:name', (req, res) => { | ||
| // This line directly takes the user input and appends it to the directory path | ||
| const attachmentName = req.params.name; | ||
| const attachmentPath = path.join(__dirname, 'attachments', attachmentName); | ||
|
|
||
| // Check if file exists | ||
| if (!fs.existsSync(attachmentPath)) { | ||
| return res.status(404).send('Attachment not found'); | ||
| } | ||
|
|
||
| // Read the file and send it in the response | ||
| fs.readFile(attachmentPath, (err, data) => { | ||
| if (err) { | ||
| return res.status(500).send('Error reading file'); | ||
| } | ||
| res.setHeader('Content-Type', 'text/plain'); | ||
| res.send(data); | ||
| }); | ||
| }); |
Check failure
Code scanning / CodeQL
Missing rate limiting
This PR introduces a SQL Injection new login endpoint which Mayhem for API detects