Add admin panel and notification service#1
Conversation
|
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const sort = req.query.sort || 'username'; | ||
| const query = `SELECT * FROM users WHERE role = '${role}' ORDER BY ${sort}`; | ||
| try { | ||
| const users = db.prepare(query).all(); |
Check failure
Code scanning / SonarCloud
Database queries should not be vulnerable to injection attacks High
| app.post('/admin/diagnostics', (req, res) => { | ||
| const { command } = req.body; | ||
| // HIGH: Direct command execution from user input | ||
| exec(command, { timeout: 10000 }, (error, stdout, stderr) => { |
Check failure
Code scanning / SonarCloud
OS commands should not be vulnerable to command injection attacks High
| const setClauses = Object.keys(updates).map(k => `${k} = '${updates[k]}'`).join(', '); | ||
| const query = `UPDATE users SET ${setClauses} WHERE id = ${userId}`; | ||
| try { | ||
| db.prepare(query).run(); |
Check failure
Code scanning / SonarCloud
Database queries should not be vulnerable to injection attacks High
| const content = req.body.content; | ||
| // MEDIUM: No file type validation, writing to arbitrary path | ||
| const uploadPath = path.join('/tmp/uploads', filename); | ||
| fs.writeFileSync(uploadPath, content); |
Check failure
Code scanning / SonarCloud
I/O function calls should not be vulnerable to path injection attacks High
| app.post('/admin/encrypt', (req, res) => { | ||
| const { data } = req.body; | ||
| // MEDIUM: ECB mode is insecure | ||
| const cipher = crypto.createCipheriv('aes-128-ecb', ENCRYPTION_KEY.slice(0, 16), null); |
Check failure
Code scanning / SonarCloud
Encryption algorithms should be used with secure mode and padding scheme High
| app.get('/admin/render', (req, res) => { | ||
| const template = req.query.template; | ||
| try { | ||
| const rendered = eval('`' + template + '`'); |
Check failure
Code scanning / SonarCloud
Dynamic code execution should not be vulnerable to injection attacks High
| const { url } = req.query; | ||
| // MEDIUM: No URL validation - can access internal services | ||
| try { | ||
| const response = await fetch(url); |
Check warning
Code scanning / SonarCloud
Server-side requests should not be vulnerable to forging attacks Medium
2 participants
New Features
Endpoints Added
GET /admin/users- List users by rolePOST /admin/diagnostics- System diagnosticsGET /admin/logs- View log filesPUT /admin/users/:id- Update userPOST /admin/upload- File uploadPOST /admin/encrypt- Data encryptionGET /admin/fetch-url- URL fetcherGET /admin/dashboard- Admin dashboardGET /admin/render- Template renderingPOST /admin/delete-all-users- Bulk user deletion