Skip to content

add new endpoint function #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
philvarner-snyk wants to merge 4 commits into
base: main
Choose a base branch
from
Open

add new endpoint function #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f2f3e4e
add new endpoint function
philvarner-snyk Dec 12, 2025
1562a64
try sbom
philvarner-snyk Jan 6, 2026
a563b06
add vulnerable package
philvarner-snyk Jan 6, 2026
cc11908
Merge branch 'main' into new-api-endpoint-update
philvarner-snyk Jan 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 10 additions & 19 deletions .github/workflows/snyk-security-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
# env:
# SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
# SNYK_CFG_ORG: varner-tech-engineering

# steps:
# - name: Checkout code
# uses: actions/checkout@v3
Expand Down Expand Up @@ -55,24 +55,15 @@ jobs:
permissions:
contents: write
actions: read
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Setup Snyk CLI
uses: snyk/actions/setup@master

- name: Authenticate Snyk CLI
run: snyk auth "${{ secrets.SNYK_TOKEN }}"

- name: Generate SBOM (CycloneDX JSON)
run: |
echo "Generating SBOM with Snyk..."
snyk sbom --format=cyclonedx1.6+json > sbom.cdx.json
echo "SBOM generation completed successfully"
ls -la sbom.cdx.json
uses: anchore/sbom-action@v0
with:
format: cyclonedx-json
output-file: sbom.cdx.json

- name: Upload SBOM artifact
uses: actions/upload-artifact@v4
Expand All @@ -86,8 +77,8 @@ jobs:
with:
files: sbom.cdx.json

- name: Display SBOM info
run: |
echo "SBOM generated successfully"
ls -la sbom.cdx.json
echo "SBOM size: $(wc -c < sbom.cdx.json) bytes"
- name: Submit SBOM to Dependency Graph
uses: advanced-security/sbom-dependency-submission-action@v0
with:
sbom-path: sbom.cdx.json
fail-on-error: true
90 changes: 72 additions & 18 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
"lodash": "4.17.4",
"marked": "0.3.5",
"method-override": "latest",
"minimist": "0.0.8",
"moment": "2.15.1",
"mongodb": "^3.5.9",
"mongoose": "4.2.4",
Expand All @@ -46,6 +47,7 @@
"mysql": "^2.18.1",
"npmconf": "0.0.24",
"optional": "^0.1.3",
"serialize-javascript": "2.1.1",
"st": "0.2.4",
"stream-buffers": "^3.0.1",
"tap": "^11.1.3",
Expand Down
14 changes: 7 additions & 7 deletions routes/xss-vulnerable.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,15 +17,15 @@ const { startVulnerableResponse } = require('../service/xssResponder');

// UNSAFE: Direct XSS vulnerability - matches pattern Snyk detects
// This is a simple reflected XSS that Snyk should flag
// router.get('/', (req, res) => {
// // Get user input directly from query parameter without sanitization
// // This is the source of the XSS vulnerability
// const userInput = req.query.input || 'No input provided';
router.get('/', (req, res) => {
// Get user input directly from query parameter without sanitization
// This is the source of the XSS vulnerability
const userInput = req.query.input || 'No input provided';

// const html = processUserInput(userInput, res);
const html = processUserInput(userInput, res);

// res.send(html);
// });
res.send(html);
Copy link
Collaborator Author

@philvarner-snyk philvarner-snyk Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 27 | CWE-79 | Priority score 850 | Learn more about this vulnerability
Data flow: 14 steps

Step 1 - 7

nodejs-goof/routes/xss-vulnerable.js

Line 23 in f2f3e4e

const userInput = req.query.input || 'No input provided';

Step 8 routes/xss-vulnerable.js#L25

Step 9 routes/xss-vulnerable.js#L30

Step 10 routes/xss-vulnerable.js#L39

Step 11 routes/xss-vulnerable.js#L31

Step 12 routes/xss-vulnerable.js#L25

Step 13 - 14

nodejs-goof/routes/xss-vulnerable.js

Line 27 in f2f3e4e

res.send(html);

Commands
  • ⚡ To see AI-powered Snyk Agent Fix suggestions, reply with: @snyk /fix. You'll need to refresh the page 🔄

Copy link
Collaborator Author

@philvarner-snyk philvarner-snyk Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@snyk /fix

Copy link
Collaborator Author

@philvarner-snyk philvarner-snyk Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚡ Snyk Agent Fix suggestion 1 of 5

The original code snippet had a security vulnerability where user input for userInput was sent directly to the end-user without sanitization, potentially allowing for Cross-Site Scripting (XSS) attacks. The amended code changes the response Content-Type to text/plain, ensuring that the output is treated as plain text and not interpreted as HTML or JavaScript by the client. This simple change mitigates the risk of XSS by displaying user input as literal text rather than executable code. The processUserInput function is presumably where input sanitization would occur to prevent secure data from being displayed as hotlinked text, but this snippet doesn't include that logic. generated by AI

Code changes 
--- routes/xss-vulnerable.js
+++ routes/xss-vulnerable.js
@@ -24,7 +24,7 @@
 
     const html = processUserInput(userInput, res);
 
-    res.send(html);
+    res.contentType('text/plain').send(html);
 });
 
 function processUserInput(userInput, res) {
Content generated by AI, expires on 2025-12-13 07:09:28 UTC. Refresh the page after running Snyk commands.
Commands

  • ⏩ To see another AI-powered fix suggestion - reply with @snyk /fix

  • ✅ To apply this fix and create a commit - reply with @snyk /apply 1

});

function processUserInput(userInput, res) {
return `
Expand Down