function parseTarget(raw) {
const input = (raw || '').trim();
if (!input) return { error: 'Target is required.' };
JS 1.0 · Project evidence
JS Todo App (SQLite 5): Find Vulnerabilities
Uptime and health check app with Express. Scaffolded from Cursor's Auto MAX mode.
Project purpose and scale
JS Todo App (SQLite 5): Find Vulnerabilities
Uptime and health check app with Express. Scaffolded from Cursor's Auto MAX mode.
- Source files
- 8
- Reference findings
- 11
- Matched signatures
- 37
- Unmatched signatures
- 23
Reference context
Deterministic reference findings
These findings define the project reference set for JS 1.0. Their presence does not establish exhaustive ground truth.
| Class | Severity | Location | Reference ID |
|---|---|---|---|
| improper-type-validation | low | server.js:85 | js-improper-type-validation-5 |
| information-exposure | low | server.js:37 | js-cookie-secure-flag-false-5 |
| csrf | medium | server.js:17 | js-csrf-missing-5 |
| information-exposure | medium | server.js:17 | js-xpowered-by-header-5 |
| allocation-of-resources-without-limits-or-throttling | medium | server.js:176 | js-alloc-without-limits-5a |
| allocation-of-resources-without-limits-or-throttling | medium | server.js:186 | js-alloc-without-limits-5b |
| allocation-of-resources-without-limits-or-throttling | medium | server.js:221 | js-alloc-without-limits-5c |
| open-redirect | medium | server.js:218 | js-open-redirect-5 |
| command-injection | high | server.js:124 | js-command-injection-5 |
| hardcoded-credentials | high | server.js:33 | js-hardcoded-secret-5 |
| ssrf | high | server.js:139 | js-ssrf-5 |
Finding evidence
Reference-matched normalized signatures
Matched means agreement with the Snyk Code reference set, not independent ground-truth adjudication.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.6 High | command-injection | high | server.js:124 | 5 of 5 | Unsanitized input from the HTTP request body flows into promisified command execution function, where it is used to build a shell command. This may result in a Command Injection vulnerability. | 1 |
| Claude Opus 4.6 High | hardcoded-credentials | high | server.js:33 | 5 of 5 | Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in express-session. | 1 |
| Claude Opus 4.6 High | information-exposure | low | server.js:37 | 1 of 5 | Cookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks. | 1 |
| Claude Opus 4.6 High | open-redirect | medium | server.js:218 | 5 of 5 | Unsanitized input from an HTTP parameter flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability. | 1 |
| Claude Opus 4.6 High | ssrf | high | server.js:139 | 5 of 5 | Unsanitized input from the HTTP request body flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability. | 1 |
| Claude Opus 4.6 Medium | command-injection | high | server.js:124 | 5 of 5 | Unsanitized input from the HTTP request body flows into promisified command execution function, where it is used to build a shell command. This may result in a Command Injection vulnerability. | 1 |
| Claude Opus 4.6 Medium | hardcoded-credentials | high | server.js:33 | 5 of 5 | Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in express-session. | 1 |
| Claude Opus 4.6 Medium | open-redirect | medium | server.js:218 | 5 of 5 | Unsanitized input from an HTTP parameter flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability. | 1 |
| Claude Opus 4.6 Medium | ssrf | high | server.js:139 | 5 of 5 | Unsanitized input from the HTTP request body flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability. | 1 |
| Claude Opus 4.7 Max | allocation-of-resources-without-limits-or-throttling | medium | server.js:176 | 5 of 5 | Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit. | 1 |
| Claude Opus 4.7 Max | allocation-of-resources-without-limits-or-throttling | medium | server.js:186 | 1 of 5 | Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit. | 1 |
| Claude Opus 4.7 Max | command-injection | high | server.js:124 | 5 of 5 | Unsanitized input from the HTTP request body flows into promisified command execution function, where it is used to build a shell command. This may result in a Command Injection vulnerability. | 1 |
| Claude Opus 4.7 Max | csrf | medium | server.js:17 | 5 of 5 | CSRF protection is disabled for your Express app. This allows the attackers to execute requests on a user's behalf. | 1 |
| Claude Opus 4.7 Max | hardcoded-credentials | high | server.js:33 | 5 of 5 | Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in express-session. | 1 |
| Claude Opus 4.7 Max | improper-type-validation | low | server.js:85 | 4 of 5 | The type of this object, coming from body and the value of its trim property can be controlled by the user. An attacker may craft the properties of the object to crash the application or bypass its logic. Consider checking the type of the object. | 1 |
| Claude Opus 4.7 Max | information-exposure | medium | server.js:17 | 1 of 5 | Disable X-Powered-By header for your Express app (consider using Helmet middleware), because it exposes information about the used framework to potential attackers. | 1 |
| Claude Opus 4.7 Max | information-exposure | low | server.js:37 | 5 of 5 | Cookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks. | 1 |
| Claude Opus 4.7 Max | open-redirect | medium | server.js:218 | 5 of 5 | Unsanitized input from an HTTP parameter flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability. | 1 |
| Claude Opus 4.7 Max | ssrf | high | server.js:139 | 5 of 5 | Unsanitized input from the HTTP request body flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability. | 1 |
| Claude Sonnet 4.6 High | allocation-of-resources-without-limits-or-throttling | medium | server.js:176 | 3 of 5 | Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit. | 1 |
| Claude Sonnet 4.6 High | allocation-of-resources-without-limits-or-throttling | medium | server.js:186 | 1 of 5 | Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit. | 1 |
| Claude Sonnet 4.6 High | command-injection | high | server.js:124 | 5 of 5 | Unsanitized input from the HTTP request body flows into promisified command execution function, where it is used to build a shell command. This may result in a Command Injection vulnerability. | 1 |
| Claude Sonnet 4.6 High | csrf | medium | server.js:17 | 5 of 5 | CSRF protection is disabled for your Express app. This allows the attackers to execute requests on a user's behalf. | 1 |
| Claude Sonnet 4.6 High | hardcoded-credentials | high | server.js:33 | 5 of 5 | Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in express-session. | 1 |
| Claude Sonnet 4.6 High | information-exposure | medium | server.js:17 | 2 of 5 | Disable X-Powered-By header for your Express app (consider using Helmet middleware), because it exposes information about the used framework to potential attackers. | 1 |
| Claude Sonnet 4.6 High | information-exposure | low | server.js:37 | 5 of 5 | Cookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks. | 1 |
| Claude Sonnet 4.6 High | open-redirect | medium | server.js:218 | 5 of 5 | Unsanitized input from an HTTP parameter flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability. | 1 |
| Claude Sonnet 4.6 High | ssrf | high | server.js:139 | 5 of 5 | Unsanitized input from the HTTP request body flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability. | 1 |
| Claude Sonnet 4.6 Medium | allocation-of-resources-without-limits-or-throttling | medium | server.js:176 | 4 of 5 | Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit. | 1 |
| Claude Sonnet 4.6 Medium | command-injection | high | server.js:124 | 5 of 5 | Unsanitized input from the HTTP request body flows into promisified command execution function, where it is used to build a shell command. This may result in a Command Injection vulnerability. | 1 |
| Claude Sonnet 4.6 Medium | csrf | medium | server.js:17 | 5 of 5 | CSRF protection is disabled for your Express app. This allows the attackers to execute requests on a user's behalf. | 1 |
| Claude Sonnet 4.6 Medium | hardcoded-credentials | high | server.js:33 | 5 of 5 | Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in express-session. | 1 |
| Claude Sonnet 4.6 Medium | improper-type-validation | low | server.js:85 | 1 of 5 | The type of this object, coming from body and the value of its trim property can be controlled by the user. An attacker may craft the properties of the object to crash the application or bypass its logic. Consider checking the type of the object. | 1 |
| Claude Sonnet 4.6 Medium | information-exposure | medium | server.js:17 | 5 of 5 | Disable X-Powered-By header for your Express app (consider using Helmet middleware), because it exposes information about the used framework to potential attackers. | 1 |
| Claude Sonnet 4.6 Medium | information-exposure | low | server.js:37 | 5 of 5 | Cookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks. | 1 |
| Claude Sonnet 4.6 Medium | open-redirect | medium | server.js:218 | 5 of 5 | Unsanitized input from an HTTP parameter flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability. | 1 |
| Claude Sonnet 4.6 Medium | ssrf | high | server.js:139 | 5 of 5 | Unsanitized input from the HTTP request body flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability. | 1 |
Finding evidence
Unmatched normalized signatures
Unmatched reports may be false-positive-shaped, adjacent, or likely product-gap candidates.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.6 High | insecure-transport | low | server.js:37 | 1 of 5 | Session cookie is configured with secure:false and no sameSite attribute, allowing session cookies to be transmitted over unencrypted HTTP and included in cross-site requests. | 1 |
| Claude Opus 4.6 High | insecure-transport | low | server.js:38 | 3 of 5 | Session cookie is configured with secure: false, allowing it to be transmitted over unencrypted HTTP connections where it can be intercepted by network attackers. | 3 |
| Claude Opus 4.6 Medium | insecure-transport | low | server.js:38 | 3 of 5 | Session cookie has secure: false, allowing it to be transmitted over unencrypted HTTP connections, exposing session tokens to network interception. | 3 |
| Claude Opus 4.7 Max | insecure-transport | medium | server.js:38 | 5 of 5 | Session cookie configured with `secure: false` and no `httpOnly`/`sameSite` flags, allowing cookie transmission over plain HTTP and exposure to JavaScript/CSRF. | 5 |
| Claude Opus 4.7 Max | other | low | server.js:36 | 2 of 5 | express-session configured with saveUninitialized:true, creating sessions for unauthenticated visitors and increasing attack surface for session fixation and storage exhaustion. | 2 |
| Claude Opus 4.7 Max | redos | low | server.js:80 | 4 of 5 | Hostname regex uses nested quantifiers ([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)* allowing potentially catastrophic backtracking on crafted inputs; bounded but still costly. | 4 |
| Claude Sonnet 4.6 High | command-injection | critical | server.js:75 | 3 of 5 | All three regex patterns in isSafePingHost() (IPv4 at line 75, IPv6 at line 77, hostname at line 79-81) lack end anchors ($). The patterns only check that the string starts with a valid value, allowing arbitrary shell-injectable content to follow (e.g., '1.1.1.1; rm -rf /' passes the IPv4 check). | 3 |
| Claude Sonnet 4.6 High | command-injection | critical | server.js:80 | 1 of 5 | The hostname regex in isSafePingHost is missing a `$` end anchor, so inputs like `example.com; id` pass validation and can be injected into the shell command constructed in runPing. | 1 |
| Claude Sonnet 4.6 High | information-exposure | low | index.hbs:8 | 1 of 5 | The server's OS hostname (`os.hostname()`) is rendered on the public home page, leaking internal infrastructure naming that could assist an attacker in reconnaissance. | 1 |
| Claude Sonnet 4.6 High | insecure-transport | medium | server.js:38 | 5 of 5 | Session cookie is configured with secure: false, allowing transmission over plain HTTP and exposing it to network interception. The cookie also lacks a sameSite attribute, and maxAge is set to ~3 years (99999999999 ms), creating extremely long-lived sessions. | 5 |
| Claude Sonnet 4.6 High | open-redirect | high | server.js:215 | 1 of 5 | Missing `return` after `res.redirect(302, '/')` inside the protective if-block in the /visitPage handler. Execution always falls through to `res.redirect(target)` on line 218, making the safety check completely ineffective and the open redirect unconditional. | 1 |
| Claude Sonnet 4.6 High | other | medium | server.js:216 | 1 of 5 | Missing return after res.redirect(302, '/') at line 216. Execution always falls through to res.redirect(target) at line 218. When the safety condition is met (target === '/visitPage'), two response calls are made, causing a 'headers already sent' crash and allowing the redirect to target to also fire, defeating the guard. | 1 |
| Claude Sonnet 4.6 High | prototype-pollution | medium | server.js:143 | 1 of 5 | HTTP response headers from a remote (potentially attacker-controlled) server are assigned into a plain `{}` object without filtering reserved keys. If the remote server returns a header named `__proto__`, `constructor`, or `prototype`, the assignment `headers[key] = value` can pollute the JavaScript object prototype chain. | 1 |
| Claude Sonnet 4.6 Medium | command-injection | critical | server.js:75 | 4 of 5 | All three host-validation regexes in isSafePingHost() — IPv4 (/^(\d{1,3}\.){3}\d{1,3}/), IPv6 (/^[0-9a-fA-F:]+/), and hostname — are missing a `$` end anchor. JavaScript's RegExp.test() returns true when only a prefix of the string matches, so attackers append shell metacharacters (`;`, `&&`, `|`, `$()`, etc.) after a valid prefix to bypass the check entirely. | 4 |
| Claude Sonnet 4.6 Medium | command-injection | critical | server.js:77 | 3 of 5 | IPv6 regex `/^[0-9a-fA-F:]+/` in `isSafePingHost` has no end anchor `$`, so inputs like `::1; rm -rf /` pass validation and are later embedded in the shell ping command. | 3 |
| Claude Sonnet 4.6 Medium | command-injection | critical | server.js:79 | 1 of 5 | The hostname regex in isSafePingHost is not anchored at the end (missing $), so 'example.com; evil_command' matches and passes validation, enabling command injection in runPing. | 1 |
| Claude Sonnet 4.6 Medium | command-injection | critical | server.js:80 | 2 of 5 | Hostname regex in `isSafePingHost` has no end anchor `$`, allowing inputs such as `example.com && whoami` to pass host validation and be executed as shell commands via `execAsync`. | 2 |
| Claude Sonnet 4.6 Medium | information-exposure | low | server.js:181 | 1 of 5 | Internal server hostname (os.hostname()) is exposed in the index, account, and results pages. This leaks internal infrastructure naming conventions and may assist attackers in reconnaissance or targeted attacks. | 1 |
| Claude Sonnet 4.6 Medium | insecure-transport | medium | server.js:38 | 5 of 5 | Session cookie is configured with `secure: false`, allowing the session token to be transmitted over unencrypted HTTP connections where it can be intercepted. The cookie also has an extremely long `maxAge` (~3 years), prolonging the window for stolen sessions. | 5 |
| Claude Sonnet 4.6 Medium | open-redirect | high | server.js:211 | 1 of 5 | The safety guard inside `/visitPage` (`if (!target || target === '/visitPage' ...)`) is missing a `return` statement, so execution always falls through to the unvalidated `res.redirect(target)` call, making the guard ineffective. | 1 |
| Claude Sonnet 4.6 Medium | other | low | server.js:36 | 1 of 5 | saveUninitialized: true causes a session to be created and stored for every unauthenticated request, which wastes server-side storage and creates unnecessary session tokens that can be abused. | 1 |
| Claude Sonnet 4.6 Medium | other | low | server.js:39 | 2 of 5 | Session cookie maxAge is set to 99999999999 milliseconds (~3155 years), effectively creating permanent sessions and increasing the window for session hijacking if a token is compromised. | 2 |
| Claude Sonnet 4.6 Medium | ssrf | high | server.js:140 | 1 of 5 | The fetch call uses redirect:'follow', meaning if a public HTTPS URL responds with a redirect pointing to an internal/private address, the server silently follows the chain and exposes internal resources. Combined with the absence of private-IP filtering, this enables redirect-based SSRF even when the initial hostname looks public. | 1 |
Model behavior
Recurrence by configuration
Stable recurrence measures repeated behavior, not independent validity.
| Configuration | Matched signatures | Matched all five | Unmatched signatures | Unmatched all five |
|---|---|---|---|---|
| Claude Opus 4.6 High | 5 | 4 | 2 | 0 |
| Claude Opus 4.6 Medium | 4 | 4 | 1 | 0 |
| Claude Opus 4.7 Max | 10 | 7 | 3 | 1 |
| Claude Sonnet 4.6 High | 9 | 6 | 7 | 1 |
| Claude Sonnet 4.6 Medium | 9 | 7 | 10 | 1 |
Inspectable source context
Reference locations
Apache-licensed fixture excerpts are shown around declared reference lines. They are evidence, not runnable examples.
resave: false,
saveUninitialized: true,
cookie: {
secure: false,
maxAge: 99999999999,const startedAt = Date.now();
const app = express();
app.engine(const startedAt = Date.now();
const app = express();
app.engine(});
app.get('/', (req, res) => {
res.render('index', {
title: 'Health check',});
app.get('/account', (req, res) => {
let lastPingLabel = 'n/a';
if (req.session.lastPingOk === true) lastPingLabel = 'yes';});
app.post('/check', async (req, res, next) => {
try {
const parsed = parseTarget(req.body.target); res.redirect(302, '/');
}
res.redirect(target);
});
const cmd = `ping -c 4 -W 5 ${host}`;
try {
const { stdout, stderr } = await execAsync(cmd, {
timeout: 25000,
maxBuffer: 512 * 1024,
app.use(
session({
secret: 'viuvsubvsdaf2392379y8239h2r3ifubviufbv',
resave: false,
async function fetchSecurityTxtMeta(securityTxtUrl) {
const res = await fetch(securityTxtUrl, {
redirect: 'follow',
headers: { Accept: 'text/plain,*/*' },Interpretation boundary
Inspect divergence before classifying it
Unmatched reports may be false-positive-shaped, adjacent to the release reference scope, or likely valid product-gap candidates. Missed reference findings may expose representative-versus-systematic coverage behavior.
Return to explorer evidence