Add_vulnerable_code by IneHerm · Pull Request #10 · Roland-s-Demo-Org/sql-injection-demo

IneHerm · 2025-06-27T08:06:58Z

Summary by Aikido

⚠️ Security Issues: 1	🔍 Quality Issues: 5	Resolved Issues: 0

🚀 New Features

Added route to create ZIP from merged PDF and respond.
Added standalone Express server exposing local UID endpoint and listener.
Registered client-side click handler to fetch vulnerability data and render.

⚡ Enhancements

Introduced config with base64/atob-decoded credentials and logged them.

^{More info}

Co-authored-by: aikido-pr-checks[bot] <169896070+aikido-pr-checks[bot]@users.noreply.github.com>

aikido-pr-checks · 2026-02-13T14:50:24Z

CVE-2020-7746

CVE-2020-7746 in chart.js - critical severity
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.

Remediation Aikido suggests bumping this package to version 2.9.4 to resolve this issue
^{View details in Aikido Security}

@johan-aikido ignore: not interested in this version as we plan to deprecate the entire project

aikido-pr-checks · 2026-02-13T22:32:39Z

+    if (source.includes('..') || batchId.includes('..')) {
+        return res.status(400).json({ status: 'N', msg: 'Invalid input parameters' });
+    }
+    var mergedFiledpath = path.join(__basedir, './public/batchFiles/' + dateTime.create().format('Y-m-d') + `/${source}` + "/" + batchId + "/MergeFile",MergedFileName);


Path construction combines date formatting, template literals, globals, and filename assembly in one expression. Split into named intermediate variables to improve readability.

Details

✨ AI Reasoning
This line constructs a file path by combining a global base directory, a formatted date, template literals, and a batch id in a single expression. Multiple unrelated operations are composed together, making it harder to read and reason about the path components and to spot issues (e.g., escaping, separators). Splitting into intermediate variables (date, sourcePath, MergeFileName) would clarify intent and simplify debugging.

🔧 How do I fix it?
Break long lines to enhance clarity. Aim for a maximum of 80-120 characters per line, depending on the context and coding standards.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

@AikidoSec ignore: reason to ignore the issue

✅ Based on your feedback, we ignored this isssue because of the following reason:

reason to ignore the issue

aikido-pr-checks · 2026-02-13T22:32:54Z

+app.get('/', (req, res) => {
+    const uid = os.userInfo().uid;
+    res.send(`Hello World! UID: ${uid}`);
+});


Avoid returning internal system details (UID) in responses; remove or restrict this debug output.

Details

✨ AI Reasoning
The added endpoint returns and displays the OS user id in plaintext (via res.send). This appears to be diagnostic output useful for debugging but can leak environment details and is not appropriate for production endpoints without gating or removal.

🔧 How do I fix it?
Remove debugging statements like console.log, debugger, dd(), or logic bypasses like || true. Keep legitimate logging for monitoring and error handling.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

Show Fix

Remediation - low confidence
This patch mitigates the exposure of internal system details by removing the debug endpoint that returned the OS user ID in the response.

Suggested change

app.get('/', (req, res) => {

const uid = os.userInfo().uid;

res.send(`Hello World! UID: ${uid}`);

});

@AikidoSec feedback: Debug logging and console.log statements are acceptable in our troubleshooting-utils repository as these are CLI tools designed for debugging production issues.

🔴 We were not able to create a custom learning from your feedback.
This is the reason why:

The feedback is about a specific repository context for CLI tools, but the snippet shows a web response (res.send) returning UID data, which is unrelated to debug logging or console.log statements.

aikido-pr-checks · 2026-02-13T22:32:56Z

+app.listen(port, () => {
+    console.log(`Example app listening at http://localhost:${port}`);
+});


Remove or gate the startup console.log; use structured logging or conditional dev-only logging instead.

Details

✨ AI Reasoning
The added app.listen handler logs the server URL to the console, which is typical for local development but appears here alongside other unguarded debug logs. Committing such ad-hoc startup logs increases noisy output and may reveal environment details unintentionally.

🔧 How do I fix it?
Remove debugging statements like console.log, debugger, dd(), or logic bypasses like || true. Keep legitimate logging for monitoring and error handling.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

Show Fix

Remediation - low confidence
This patch mitigates the debug artifact on line 68 by removing the ad-hoc console.log statement that logged the server startup URL, which was typical development output not appropriate for production code.

Suggested change

app.listen(port, () => {

console.log(`Example app listening at http://localhost:${port}`);

});

app.listen(port);

@AikidoSec ignore: false positive

✅ Based on your feedback, we ignored this isssue because of the following reason:

false positive

aikido-pr-checks · 2026-06-17T02:38:55Z

@@ -0,0 +1,96 @@
+
+var express = require('express');


Duplicate Express initialization: require('express') and related router/app setup are repeated. Consolidate into a single Express instance and unified routing.

Details

✨ AI Reasoning
The diff adds two separate imports/uses of Express that instantiate distinct HTTP handling (router vs app) within the same file. This repeats the same library initialization and server setup logic. Maintaining both means the same responsibility is handled in two places, increasing maintenance burden and risk of inconsistent changes. Consolidating Express initialization and routing would reduce duplication and potential for bugs when modifying server behavior.

🔧 How do I fix it?
Delete extra code. Extract repeated code sequences into reusable functions or methods. Use loops or data structures to eliminate repetitive patterns.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-06-17T02:38:57Z

+    var mergedFiledpath = path.join(__basedir, './public/batchFiles/' + dateTime.create().format('Y-m-d') + `/${source}` + "/" + batchId + "/MergeFile",MergedFileName);
+
+    var fileName = "MergedBatchFile_" + batchId + ".zip";
+    var FileLocation = path.join(__basedir, './public/batchFiles/' + dateTime.create().format('Y-m-d') + `/${source}` + "/" + batchId + "/" + fileName);


Building FileLocation mixes date formatting and complex path templating on one line. Break into interim variables (date, sourcePath, fileName) to simplify and improve readability.

Suggested change

var FileLocation = path.join(__basedir, './public/batchFiles/' + dateTime.create().format('Y-m-d') + `/${source}` + "/" + batchId + "/" + fileName);

var date = dateTime.create().format('Y-m-d');

var sourcePath = './public/batchFiles/' + date + `/${source}` + "/" + batchId;

var FileLocation = path.join(__basedir, sourcePath, fileName);

Details

✨ AI Reasoning
This line computes FileLocation via path.join while embedding dateTime.create().format(...) and template literals in a single expression. It mixes runtime date formatting and path composition, making it harder to validate paths, trace file locations, or adjust components independently.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-06-17T02:38:58Z

+  console.log(config);
+
+
+  const express = require('express');


const express = require('express') redeclares express after it was already declared earlier, causing a SyntaxError and preventing the module from loading.

Suggested change

const express = require('express');

Details

✨ AI Reasoning
The module declares the same identifier twice in the same scope. Because module parsing fails, none of the server logic can execute.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-06-17T02:38:59Z

+    console.log(`Example app listening at http://localhost:${port}`);
+});
+
+function addingEventListenerToFetchData() {


addingEventListenerToFetchData() is executed at load and uses document, which is undefined in a Node/Express runtime, causing an immediate ReferenceError.

Details

✨ AI Reasoning
Code that depends on a browser DOM API runs immediately when the module is loaded. In a server runtime, this global does not exist, so execution stops before any request handling can occur.

🔧 How do I fix it?
Trace execution paths carefully. Ensure precondition checks happen before using values, validate ranges before checking impossible conditions, and don't check for states that the code has already ruled out.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-06-17T02:39:13Z

+  console.log(config);
+
+
+  const express = require('express');


This will fix the Eliminate obvious within-file duplication issue detected on line: 2.

Show Fix

Aikido AutoFix Patch Suggestion - low confidence
This patch mitigates duplicate Express initialization by consolidating the two separate require('express') statements into a single shared import at the top of the file.

Suggested change

const express = require('express');

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
More info

aikido-pr-checks · 2026-06-17T02:39:19Z

+    });
+}
+// Used to register event on the button or any other component
+addingEventListenerToFetchData();


This will fix the Detect contradictory or impossible logic issue detected on line: 73.

Show Fix

Aikido AutoFix Patch Suggestion - low confidence
This patch mitigates the ReferenceError caused by immediate execution of browser-specific code in a Node.js environment by guarding the invocation of addingEventListenerToFetchData() with a runtime check for the document object.

Suggested change

addingEventListenerToFetchData();

if (typeof document !== 'undefined') {

addingEventListenerToFetchData();

}

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
More info

aikido-pr-checks · 2026-06-17T02:39:22Z

+const config = {
+    db: {
+      user: "admin",
+      password: Buffer.from("c3VwZXJTZWNyZXQxMjMh", "base64").toString("utf-8"), // Decodes to "superSecret123!"
+      host: "db.example.com",
+      port: 5432
+    },
+    api: {
+      key: atob("YXBpS2V5LTQ1NkFBQkM="), // Decodes to "apiKey-456AABC"
+      token: (() => {
+        const encoded = ["ZXZlbnRz", "LWFwaS0xMjM0"]; // ["events", "-api-1234"]
+        return encoded.join(""); // "events-api-1234"
+      })()
+    }
+  };
+
+  console.log(config);


Module-level config holds decoded credentials/tokens in process memory, causing sensitive data to persist across requests. Load secrets per-request or from a secure secrets manager/environment at runtime instead.

Show fix

Suggested change

const config = {

db: {

user: "admin",

password: Buffer.from("c3VwZXJTZWNyZXQxMjMh", "base64").toString("utf-8"), // Decodes to "superSecret123!"

host: "db.example.com",

port: 5432

},

api: {

key: atob("YXBpS2V5LTQ1NkFBQkM="), // Decodes to "apiKey-456AABC"

token: (() => {

const encoded = ["ZXZlbnRz", "LWFwaS0xMjM0"]; // ["events", "-api-1234"]

return encoded.join(""); // "events-api-1234"

})()

}

};

console.log(config);

function getConfig() {

return {

db: {

user: process.env.DB_USER || "admin",

password: process.env.DB_PASSWORD || Buffer.from("c3VwZXJTZWNyZXQxMjMh", "base64").toString("utf-8"),

host: process.env.DB_HOST || "db.example.com",

port: process.env.DB_PORT || 5432

},

api: {

key: process.env.API_KEY || atob("YXBpS2V5LTQ1NkFBQkM="),

token: process.env.API_TOKEN || (() => {

const encoded = ["ZXZlbnRz", "LWFwaS0xMjM0"];

return encoded.join("");

})()

}

};

}

console.log(getConfig());

Details

✨ AI Reasoning
The change introduces a module-level constant named config (lines starting at 38). It decodes and holds credentials and API tokens in plain memory. Module-scope objects persist for the lifetime of the Node.js process and are shared across all requests and users. This can lead to unintended caching of sensitive data or information leakage if the process handles multiple tenants/requests. The rest of the added code does not create request-scoped data at module scope; route-local variables are created inside the handler and are request-scoped. Therefore, only the config object meets the rule criteria.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

IneHerm and others added 4 commits June 27, 2025 10:06

Add_vulnerable_code

718581c

Update issues.js

0c49fe9

Co-authored-by: aikido-pr-checks[bot] <169896070+aikido-pr-checks[bot]@users.noreply.github.com>

Fix comment formatting in issues.js

1def41f

Fix comment formatting in issues.js

b0dea43

dejarno reviewed Jan 9, 2026

View reviewed changes

Comment thread issues.js

dejarno and others added 2 commits January 9, 2026 10:35

Apply suggestion from @dejarno

f6e0b72

Update issues.js

879c598

Co-authored-by: aikido-pr-checks[bot] <169896070+aikido-pr-checks[bot]@users.noreply.github.com>

aikido-pr-checks Bot reviewed Feb 13, 2026

View reviewed changes

aikido-pr-checks Bot reviewed Jun 17, 2026

View reviewed changes

-    var FileLocation = path.join(__basedir, './public/batchFiles/' + dateTime.create().format('Y-m-d') + `/${source}` + "/" + batchId + "/" + fileName);
+    var date = dateTime.create().format('Y-m-d');
+    var sourcePath = './public/batchFiles/' + date + `/${source}` + "/" + batchId;
+    var FileLocation = path.join(__basedir, sourcePath, fileName);

Uh oh!

Conversation

IneHerm commented Jun 27, 2025 • edited by aikido-pr-checks Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Aikido

Uh oh!

Uh oh!

aikido-pr-checks Bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

vinit-aikido Mar 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

IneHerm Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

IneHerm Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

IneHerm Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

IneHerm commented Jun 27, 2025 •

edited by aikido-pr-checks Bot

Loading

vinit-aikido Mar 8, 2026 •

edited

Loading

aikido-pr-checks Bot Jun 17, 2026 •

edited

Loading

aikido-pr-checks Bot Jun 17, 2026 •

edited

Loading