};
profile[section][key] = value;
res.json({ profile });
});JS 1.0 · Project evidence
JS Snippet (Import Profile): Find Vulnerabilities
Small Express supplier import profile service with dynamic field mapping.
Project purpose and scale
JS Snippet (Import Profile): Find Vulnerabilities
Small Express supplier import profile service with dynamic field mapping.
- Source files
- 2
- Reference findings
- 1
- Matched signatures
- 5
- Unmatched signatures
- 18
Reference context
Deterministic reference findings
These findings define the project reference set for JS 1.0. Their presence does not establish exhaustive ground truth.
| Class | Severity | Location | Reference ID |
|---|---|---|---|
| prototype-pollution | medium | app.js:17 | jrb-prototype-pollution-1 |
Finding evidence
Reference-matched normalized signatures
Matched means agreement with the Snyk Code reference set, not independent ground-truth adjudication.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.6 High | prototype-pollution | medium | app.js:17 | 5 of 5 | User-controlled nested property names are written directly into an object profile. | 1 |
| Claude Opus 4.6 Medium | prototype-pollution | medium | app.js:17 | 5 of 5 | User-controlled nested property names are written directly into an object profile. | 1 |
| Claude Opus 4.7 Max | prototype-pollution | medium | app.js:17 | 5 of 5 | User-controlled nested property names are written directly into an object profile. | 1 |
| Claude Sonnet 4.6 High | prototype-pollution | medium | app.js:17 | 5 of 5 | User-controlled nested property names are written directly into an object profile. | 1 |
| Claude Sonnet 4.6 Medium | prototype-pollution | medium | app.js:17 | 5 of 5 | User-controlled nested property names are written directly into an object profile. | 1 |
Finding evidence
Unmatched normalized signatures
Unmatched reports may be false-positive-shaped, adjacent, or likely product-gap candidates.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.7 Max | improper-type-validation | low | app.js:9 | 2 of 5 | The handler does not validate the types of req.body.section, req.body.key, or req.body.value before using them as object keys/values, allowing non-string inputs that contribute to the prototype-pollution sink and unexpected behavior. | 2 |
| Claude Sonnet 4.6 High | allocation-of-resources-without-limits-or-throttling | medium | app.js:8 | 4 of 5 | The POST /imports/profile endpoint has no rate limiting or request throttling. An attacker can send an unlimited number of requests, potentially causing denial of service through resource exhaustion. | 4 |
| Claude Sonnet 4.6 High | allocation-of-resources-without-limits-or-throttling | medium | app.js:27 | 1 of 5 | Neither endpoint applies rate limiting or request throttling. The express.json() body parser is configured with no explicit size limit override, and no middleware such as express-rate-limit is used, making both endpoints vulnerable to denial-of-service via request flooding. | 1 |
| Claude Sonnet 4.6 High | csrf | medium | app.js:8 | 2 of 5 | The POST /imports/profile endpoint performs a state-changing operation with no CSRF token validation. In contexts where the endpoint is accessed by authenticated browser sessions, a malicious cross-origin page could forge requests that modify import profiles or trigger prototype pollution. | 2 |
| Claude Sonnet 4.6 High | improper-type-validation | high | app.js:9 | 2 of 5 | The 'section', 'key', and 'value' fields from req.body are used without type checking or whitelist validation. 'section' is never restricted to the valid property names ('columns' or 'defaults'), allowing arbitrary property creation on the profile object and enabling the prototype pollution attack path. | 2 |
| Claude Sonnet 4.6 High | improper-type-validation | medium | app.js:17 | 1 of 5 | The `section`, `key`, and `value` fields from req.body are only guarded with a falsy-default (`|| 'columns'`), but their types are never validated. Sending a non-string (e.g. an object or array) for `section` or `key` causes unexpected behavior, can bypass intended logic, and amplifies the prototype pollution risk. | 1 |
| Claude Sonnet 4.6 High | information-exposure | low | app.js:5 | 1 of 5 | While `x-powered-by` is disabled, no other security headers are set (e.g., Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security). The helmet middleware or equivalent is absent, reducing the defense-in-depth posture of the application. | 1 |
| Claude Sonnet 4.6 High | information-exposure | low | app.js:21 | 2 of 5 | The GET /imports/profile endpoint returns internal configuration data (column names, default warehouse mappings) without any authentication or authorization check, exposing application internals to unauthenticated callers. | 2 |
| Claude Sonnet 4.6 High | other | high | app.js:8 | 2 of 5 | Neither the POST nor GET /imports/profile endpoints require any authentication or authorization. Any unauthenticated user on the network can read and arbitrarily modify import profile configuration. | 2 |
| Claude Sonnet 4.6 High | other | medium | app.js:17 | 2 of 5 | If `section` is any value other than 'columns' or 'defaults', `profile[section]` is undefined and the assignment `undefined[key] = value` throws an uncaught TypeError. There is no try/catch or section allowlist, so this crashes the request handler and can be triggered trivially to cause denial of service on individual requests. | 2 |
| Claude Sonnet 4.6 Medium | allocation-of-resources-without-limits-or-throttling | low | app.js:6 | 1 of 5 | express.json() is used without a body size limit specified. Although Express defaults to 100kb, there is no explicit rate limiting or request throttling on any endpoint, making the service susceptible to abuse via high-frequency requests. | 1 |
| Claude Sonnet 4.6 Medium | allocation-of-resources-without-limits-or-throttling | medium | app.js:8 | 3 of 5 | Neither the POST /imports/profile nor the GET /imports/profile endpoint applies any rate-limiting or request-throttling middleware. An attacker can flood the service with requests, exhausting CPU/memory and causing denial of service. | 3 |
| Claude Sonnet 4.6 Medium | allocation-of-resources-without-limits-or-throttling | high | app.js:17 | 1 of 5 | If 'section' is any value other than 'columns' or 'defaults', profile[section] is undefined, and the subsequent property assignment throws an uncaught TypeError. This is trivially exploitable for denial of service by any unauthenticated caller sending arbitrary 'section' values. | 1 |
| Claude Sonnet 4.6 Medium | allocation-of-resources-without-limits-or-throttling | medium | app.js:25 | 1 of 5 | No rate-limiting or request throttling middleware is applied to any route, making the service vulnerable to abuse and amplified denial-of-service attacks. | 1 |
| Claude Sonnet 4.6 Medium | csrf | low | app.js:8 | 2 of 5 | The POST /imports/profile endpoint performs a state-mutating action with no CSRF token validation. Depending on the broader authentication context, cross-site requests could trigger unintended profile mutations. | 2 |
| Claude Sonnet 4.6 Medium | idor | medium | app.js:21 | 1 of 5 | The GET /imports/profile endpoint returns internal configuration data (column names and warehouse defaults) with no authentication or access control, allowing any unauthenticated user to read potentially sensitive operational data. | 1 |
| Claude Sonnet 4.6 Medium | improper-type-validation | high | app.js:9 | 3 of 5 | No type or value validation is performed on req.body.section, req.body.key, or req.body.value before use. Any string (including '__proto__', 'constructor', 'toString', etc.) is accepted, enabling prototype pollution and other injection attacks. Additionally, if section resolves to a non-object property, an uncaught TypeError will crash the request handler. | 3 |
| Claude Sonnet 4.6 Medium | other | high | app.js:8 | 4 of 5 | No authentication or authorization is enforced on either endpoint. Any unauthenticated actor can read import profile configuration or write arbitrary values into the profile object, including exploiting prototype pollution. | 4 |
Model behavior
Recurrence by configuration
Stable recurrence measures repeated behavior, not independent validity.
| Configuration | Matched signatures | Matched all five | Unmatched signatures | Unmatched all five |
|---|---|---|---|---|
| Claude Opus 4.6 High | 1 | 1 | 0 | 0 |
| Claude Opus 4.6 Medium | 1 | 1 | 0 | 0 |
| Claude Opus 4.7 Max | 1 | 1 | 1 | 0 |
| Claude Sonnet 4.6 High | 1 | 1 | 9 | 0 |
| Claude Sonnet 4.6 Medium | 1 | 1 | 8 | 0 |
Inspectable source context
Reference locations
Apache-licensed fixture excerpts are shown around declared reference lines. They are evidence, not runnable examples.
Interpretation boundary
Inspect divergence before classifying it
Unmatched reports may be false-positive-shaped, adjacent to the release reference scope, or likely valid product-gap candidates. Missed reference findings may expose representative-versus-systematic coverage behavior.
Return to explorer evidence