Database #6
Database #6
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
ESLint found more than 10 potential problems in the proposed changes. Check the Files changed tab for more details.
| }; | ||
|
|
||
| const findUserByEmail = async (email: string): Promise<User | null> => { | ||
| const user = await UserModel.findOne({ email: email }); |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources
| app.use(morgan('tiny')); | ||
| app.use(cors({ origin: corsUrl, optionsSuccessStatus: 200 })); | ||
|
|
||
| app.use( | ||
| session({ | ||
| secret: 'secret', |
Check failure
Code scanning / CodeQL
Hard-coded credentials
| @@ -1,8 +1,17 @@ | |||
| export const environment = process.env.NODE_ENV; | |||
| export const port = process.env.PORT || 5000; | |||
| export const timezone = process.env.TZ; | |||
| export const SECRET_KEY = process.env.SECRET_KEY || 'secret'; | |||
Check failure
Code scanning / CodeQL
Hard-coded credentials
| } | ||
| const updatedPermissions = await PermissionsModel.findByIdAndUpdate( | ||
| _id, | ||
| { action, resource, attributes: attributes || '*' }, |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources
| role.permissions = permissions; | ||
|
|
||
| try { | ||
| const updateRole = await RoleModel.findByIdAndUpdate(id, role, { |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources
|
|
||
| router.post('/register', validator(schema.registerUserSchema), Register); | ||
|
|
||
| router.get('/logout', ProtectRoutes, Logout); |
Check failure
Code scanning / CodeQL
Missing rate limiting
| session({ | ||
| secret: 'secret', | ||
| resave: false, | ||
| saveUninitialized: true, | ||
| store: sessionStore, | ||
| cookie: { | ||
| maxAge: 1000 * 60 * 60 * 24 | ||
| } | ||
| }) |
Check warning
Code scanning / CodeQL
Clear text transmission of sensitive cookie
| session({ | ||
| secret: 'secret', | ||
| resave: false, | ||
| saveUninitialized: true, | ||
| store: sessionStore, | ||
| cookie: { | ||
| maxAge: 1000 * 60 * 60 * 24 | ||
| } | ||
| }) |
Check failure
Code scanning / CodeQL
Missing CSRF middleware
| }; | ||
|
|
||
| const findRoleById = async (id: Types.ObjectId): Promise<Role | null> => { | ||
| const role = await RoleModel.findOne({ _id: id }).lean().exec(); |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources
| }; | ||
|
|
||
| const getRoleByName = async (roleName: string) => { | ||
| const role = await RoleModel.findOne({ roleName: roleName }); |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources
Todo