adding new feature #62
Conversation
This reverts commit ba5a5d1.
⛔ Snyk checks have failed. 4 issues have been found so far.
✅ security/snyk check is complete. No issues have been found. (View Details) ✅ license/snyk check is complete. No issues have been found. (View Details) ⛔ code/snyk check is complete. 4 issues have been found. (View Details) |
| } | ||
|
|
||
| // Stream the file to the client | ||
| res.sendFile(filePath); |
There was a problem hiding this comment.
Path Traversal
Unsanitized input from an HTTP parameter flows into sendFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
CWE-23 | Priority score 813 | Line 38
| this.error = null | ||
| this.confirmation = data.confirmation | ||
| this.userData = data.userData | ||
| window.open('', '_blank', 'width=500')!.document.write(this.userData) |
There was a problem hiding this comment.
Cross-site Scripting (XSS)
Unsanitized input from data from a remote resource flows into write, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).
CWE-79 | Priority score 557 | Line 59
|
|
||
| getNewCaptcha () { | ||
| this.imageCaptchaService.getCaptcha().subscribe((data: any) => { | ||
| this.captcha = this.sanitizer.bypassSecurityTrustHtml(data.image) |
There was a problem hiding this comment.
Cross-site Scripting (XSS)
Unsanitized input from data from a remote resource flows into bypassSecurityTrustHtml, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).
CWE-79 | Priority score 584 | Line 46
| }); | ||
|
|
||
| // Handle file download | ||
| app.get('/download/:filename', (req, res) => { |
There was a problem hiding this comment.
Allocation of Resources Without Limits or Throttling
This endpoint handler performs a file system operation and does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit.
CWE-770 | Priority score 575 | Line 28
No description provided.