var script2 = document.createElement("script");
script2.src = widget;
document.head.appendChild(script2);
}JS 1.0 · Project evidence
JS Snippet (Shelf Validator): Find Vulnerabilities
Small Express shelf validation page with a client-side dashboard widget loader.
Project purpose and scale
JS Snippet (Shelf Validator): Find Vulnerabilities
Small Express shelf validation page with a client-side dashboard widget loader.
- Source files
- 4
- Reference findings
- 3
- Matched signatures
- 15
- Unmatched signatures
- 8
Reference context
Deterministic reference findings
These findings define the project reference set for JS 1.0. Their presence does not establish exhaustive ground truth.
| Class | Severity | Location | Reference ID |
|---|---|---|---|
| xss | high | public/dashboard.js:8 | jsk-dom-xss-1 |
| redos | high | app.js:15 | jsk-redos-1 |
| redos | high | app.js:16 | jsk-redos-2 |
Finding evidence
Reference-matched normalized signatures
Matched means agreement with the Snyk Code reference set, not independent ground-truth adjudication.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.6 High | redos | high | app.js:15 | 5 of 5 | A nested quantified regular expression is evaluated against user-controlled shelf code input. | 1 |
| Claude Opus 4.6 High | redos | high | app.js:16 | 5 of 5 | A dynamically constructed nested quantified regular expression is evaluated against user-controlled shelf code input. | 1 |
| Claude Opus 4.6 High | xss | high | public/dashboard.js:8 | 5 of 5 | A URL search parameter is assigned to a dynamically-created script element source. | 1 |
| Claude Opus 4.6 Medium | redos | high | app.js:15 | 5 of 5 | A nested quantified regular expression is evaluated against user-controlled shelf code input. | 1 |
| Claude Opus 4.6 Medium | redos | high | app.js:16 | 5 of 5 | A dynamically constructed nested quantified regular expression is evaluated against user-controlled shelf code input. | 1 |
| Claude Opus 4.6 Medium | xss | high | public/dashboard.js:8 | 5 of 5 | A URL search parameter is assigned to a dynamically-created script element source. | 1 |
| Claude Opus 4.7 Max | redos | high | app.js:15 | 5 of 5 | A nested quantified regular expression is evaluated against user-controlled shelf code input. | 1 |
| Claude Opus 4.7 Max | redos | high | app.js:16 | 5 of 5 | A dynamically constructed nested quantified regular expression is evaluated against user-controlled shelf code input. | 1 |
| Claude Opus 4.7 Max | xss | high | public/dashboard.js:8 | 2 of 5 | A URL search parameter is assigned to a dynamically-created script element source. | 1 |
| Claude Sonnet 4.6 High | redos | high | app.js:15 | 5 of 5 | A nested quantified regular expression is evaluated against user-controlled shelf code input. | 1 |
| Claude Sonnet 4.6 High | redos | high | app.js:16 | 5 of 5 | A dynamically constructed nested quantified regular expression is evaluated against user-controlled shelf code input. | 1 |
| Claude Sonnet 4.6 High | xss | high | public/dashboard.js:8 | 5 of 5 | A URL search parameter is assigned to a dynamically-created script element source. | 1 |
| Claude Sonnet 4.6 Medium | redos | high | app.js:15 | 5 of 5 | A nested quantified regular expression is evaluated against user-controlled shelf code input. | 1 |
| Claude Sonnet 4.6 Medium | redos | high | app.js:16 | 4 of 5 | A dynamically constructed nested quantified regular expression is evaluated against user-controlled shelf code input. | 1 |
| Claude Sonnet 4.6 Medium | xss | high | public/dashboard.js:8 | 5 of 5 | A URL search parameter is assigned to a dynamically-created script element source. | 1 |
Finding evidence
Unmatched normalized signatures
Unmatched reports may be false-positive-shaped, adjacent, or likely product-gap candidates.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.7 Max | allocation-of-resources-without-limits-or-throttling | medium | app.js:10 | 1 of 5 | The `code` query parameter is read with no length validation and the endpoint has no rate limiting, allowing unbounded input sizes which amplify the ReDoS issue and enable denial-of-service. | 1 |
| Claude Opus 4.7 Max | code-injection | critical | dashboard.js:8 | 5 of 5 | DOM-based script injection / XSS: the `widget` query parameter from window.location.search is assigned directly to a dynamically created <script>'s src attribute and appended to document.head. An attacker can craft a URL like /?widget=https://attacker.example/evil.js to load and execute arbitrary JavaScript in the application's origin. | 5 |
| Claude Sonnet 4.6 High | allocation-of-resources-without-limits-or-throttling | medium | app.js:9 | 3 of 5 | The /shelves/validate endpoint applies no rate limiting or request throttling, making it trivial for an attacker to amplify the ReDoS impact by flooding the server with malicious requests. | 3 |
| Claude Sonnet 4.6 High | allocation-of-resources-without-limits-or-throttling | medium | app.js:10 | 1 of 5 | The `code` query parameter is accepted without any length restriction (`String(req.query.code || "")`), and the `/shelves/validate` endpoint has no rate-limiting middleware. This amplifies the ReDoS vulnerability: attackers can submit arbitrarily long inputs at high frequency, causing sustained CPU exhaustion on the single-threaded Node.js server. | 1 |
| Claude Sonnet 4.6 Medium | allocation-of-resources-without-limits-or-throttling | high | app.js:9 | 3 of 5 | The /shelves/validate endpoint applies no rate limiting, request-size caps, or regex-execution timeouts. An unauthenticated attacker can flood the endpoint with ReDoS payloads, starving the event loop and taking the service offline. | 3 |
| Claude Sonnet 4.6 Medium | information-exposure | low | index.html | 1 of 5 | No Content-Security-Policy header or meta tag is present. This means there is no browser-enforced restriction on script sources, making the DOM-based XSS in dashboard.js trivially exploitable and preventing any defense-in-depth against script injection attacks. | 1 |
| Claude Sonnet 4.6 Medium | information-exposure | low | index.html:1 | 1 of 5 | No Content-Security-Policy is configured (neither via HTTP header nor <meta> tag), so there is no browser-enforced restriction that would block or mitigate the DOM XSS script injection in dashboard.js. A CSP with a strict script-src directive would provide an important defence-in-depth layer. | 1 |
| Claude Sonnet 4.6 Medium | other | medium | index.html | 1 of 5 | No Content-Security-Policy (CSP) header is set anywhere in the application. The absence of a CSP makes the arbitrary script-src injection in dashboard.js trivially exploitable, as browsers will load scripts from any origin without restriction. | 1 |
Model behavior
Recurrence by configuration
Stable recurrence measures repeated behavior, not independent validity.
| Configuration | Matched signatures | Matched all five | Unmatched signatures | Unmatched all five |
|---|---|---|---|---|
| Claude Opus 4.6 High | 3 | 3 | 0 | 0 |
| Claude Opus 4.6 Medium | 3 | 3 | 0 | 0 |
| Claude Opus 4.7 Max | 3 | 2 | 2 | 1 |
| Claude Sonnet 4.6 High | 3 | 3 | 2 | 0 |
| Claude Sonnet 4.6 Medium | 3 | 2 | 4 | 0 |
Inspectable source context
Reference locations
Apache-licensed fixture excerpts are shown around declared reference lines. They are evidence, not runnable examples.
const regex2 = new RegExp(/([0-9]+)+\#/);
const firstMatch = regex1.test(code);
const secondMatch = regex2.test(code);
res.json({ valid: firstMatch || secondMatch });
const firstMatch = regex1.test(code);
const secondMatch = regex2.test(code);
res.json({ valid: firstMatch || secondMatch });
});Interpretation boundary
Inspect divergence before classifying it
Unmatched reports may be false-positive-shaped, adjacent to the release reference scope, or likely valid product-gap candidates. Missed reference findings may expose representative-versus-systematic coverage behavior.
Return to explorer evidence