-
Notifications
You must be signed in to change notification settings - Fork 6
Snyk PR Check Experience #25
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: pr-check-experience
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,90 @@ | ||||||
| /** | ||||||
| * Module dependencies. | ||||||
| */ | ||||||
|
|
||||||
| // mongoose setup | ||||||
| require('./mongoose-db'); | ||||||
| require('./typeorm-db') | ||||||
|
|
||||||
| var st = require('st'); | ||||||
| var crypto = require('crypto'); | ||||||
| var express = require('express'); | ||||||
| var http = require('http'); | ||||||
| var path = require('path'); | ||||||
| var ejsEngine = require('ejs-locals'); | ||||||
| var bodyParser = require('body-parser'); | ||||||
| var session = require('express-session') | ||||||
| var methodOverride = require('method-override'); | ||||||
| var logger = require('morgan'); | ||||||
| var errorHandler = require('errorhandler'); | ||||||
| var helmet = require('helmet'); | ||||||
| var optional = require('optional'); | ||||||
| var marked = require('marked'); | ||||||
| var fileUpload = require('express-fileupload'); | ||||||
| var dust = require('dustjs-linkedin'); | ||||||
| var dustHelpers = require('dustjs-helpers'); | ||||||
| var cons = require('consolidate'); | ||||||
| const hbs = require('hbs') | ||||||
|
|
||||||
| var app = express(); | ||||||
|
Owner
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||||||
| var routes = require('./routes'); | ||||||
| var routesUsers = require('./routes/users.js') | ||||||
|
|
||||||
| // all environments | ||||||
| app.set('port', process.env.PORT || 3001); | ||||||
| app.engine('ejs', ejsEngine); | ||||||
| app.engine('dust', cons.dust); | ||||||
| app.engine('hbs', hbs.__express); | ||||||
| cons.dust.helpers = dustHelpers; | ||||||
| app.set('views', path.join(__dirname, 'views')); | ||||||
| app.set('view engine', 'ejs'); | ||||||
| app.use(logger('dev')); | ||||||
| app.use(methodOverride()); | ||||||
| app.use(session({ | ||||||
|
Owner
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||||||
| secret: 'keyboard cat', |
Step 2
Line 42 in e3f0872
| app.use(session({ |
⚡ Fix this issue by replying with the following command: @snyk /fix
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Cookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.
Line 45 | CWE-614 | Priority score 417
⚡ Fix this issue by replying with the following command: @snyk /fix
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hardcoded Secret
Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in here.
Line 83 | CWE-547 | Priority score 834
Data flow: 2 steps
Step 1 - 2
Line 83 in e3f0872
| var token = 'SECRET_TOKEN_f8ed84e8f41e4146403dd4a6bbcea5e418d23a9'; |
⚡ Fix this issue by replying with the following command: @snyk /fix
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Cleartext Transmission of Sensitive Information
http.createServer uses HTTP which is an insecure protocol and should not be used in code due to cleartext transmission of information. Data in cleartext in a communication channel can be sniffed by unauthorized actors. Consider using the https module instead.
Line 86 | CWE-319 | Priority score 567
⚡ Fix this issue by replying with the following command: @snyk /fix
Uh oh!
There was an error while loading. Please reload this page.