Skip to content

Mattfeature #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mnemeth-opti wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Mattfeature #69

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1d09af3
Update users.js
mnemeth-opti Jan 20, 2026
f11bc71
Create baduser.js
mnemeth-opti Jan 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions javascript/baduser.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
const express = require('express');
const app = express();
const bodyParser = require('body-parser');
const mysql = require('mysql');

// Vulnerable endpoint
app.post('/login', (req, res) => {
const username = req.body.username;
const password = req.body.password;
// sample changes
const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
Comment on lines +8 to +11
Copy link

@arnica-github-connector arnica-github-connector bot Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Static Code Analysis Risk: Injection - Tainted SQL string

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.

Severity: Medium ⚠️
Status: Open 🔴

References:

  1. https://owasp.org/www-community/attacks/SQL_Injection

Suggested reviewers 🧐: @mnemeth-opti

More details:

🌻 View in Arnica

Details

Take action by replying with an [arnica] command 💬

Actions

Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.

To acknowledge the finding as a valid code risk:

[arnica] ack <acknowledge additional details>

To dismiss the risk with a reason:

[arnica] dismiss <fp|accept|capacity> <dismissal reason>

Examples

  • [arnica] ack This is a valid risk and im looking into it

  • [arnica] dismiss fp Dismissed - Risk Not Accurate: (i.e. False Positive)

  • [arnica] dismiss accept Dismiss - Risk Accepted: Allow the risk to exist in the system

  • [arnica] dismiss capacity Dismiss - No Capacity: This will need to wait for a future sprint


const connection = mysql.createConnection({
host: 'localhost',
user: 'root',
password: '',
database: 'testdb',
});

connection.query(query, (err, results) => {
//to do ...
});

});
82 changes: 41 additions & 41 deletions javascript/users.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,52 +1,52 @@

// const express = require('express');
// const app = express();
// const bodyParser = require('body-parser');
// const mysql = require('mysql');

// // Vulnerable endpoint
// app.post('/login', (req, res) => {
// const username = req.body.username;
// const password = req.body.password;
// // sample changes
// const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;

// const connection = mysql.createConnection({
// host: 'localhost',
// user: 'root',
// password: '',
// database: 'testdb',
// });
const express = require('express');
const app = express();
const bodyParser = require('body-parser');
const mysql = require('mysql');

// Vulnerable endpoint
app.post('/login', (req, res) => {
const username = req.body.username;
const password = req.body.password;
// sample changes
const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
Comment on lines +9 to +12
Copy link

@arnica-github-connector arnica-github-connector bot Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Static Code Analysis Risk: Injection - Tainted SQL string

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.

Severity: Medium ⚠️
Status: Open 🔴

References:

  1. https://owasp.org/www-community/attacks/SQL_Injection

Suggested reviewers 🧐: @mnemeth-opti

More details:

🌻 View in Arnica

Details

Take action by replying with an [arnica] command 💬

Actions

Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.

To acknowledge the finding as a valid code risk:

[arnica] ack <acknowledge additional details>

To dismiss the risk with a reason:

[arnica] dismiss <fp|accept|capacity> <dismissal reason>

Examples

  • [arnica] ack This is a valid risk and im looking into it

  • [arnica] dismiss fp Dismissed - Risk Not Accurate: (i.e. False Positive)

  • [arnica] dismiss accept Dismiss - Risk Accepted: Allow the risk to exist in the system

  • [arnica] dismiss capacity Dismiss - No Capacity: This will need to wait for a future sprint


const connection = mysql.createConnection({
host: 'localhost',
user: 'root',
password: '',
database: 'testdb',
});

// connection.query(query, (err, results) => {
// //to do ...
// });
connection.query(query, (err, results) => {
//to do ...
});

// });
});






// Parameterized Query
const connection = mysql.createConnection({
host: 'localhost',
user: 'root',
password: '',
database: 'securedb',
});
// const connection = mysql.createConnection({
// host: 'localhost',
// user: 'root',
// password: '',
// database: 'securedb',
// });

// Secure SQL query using parameterized queries
app.post('/user', (req, res) => {
const { username, email } = req.body;

const query = 'INSERT INTO users (username, email) VALUES (?, ?)';
connection.query(query, [username, email], (err, result) => {
if (err) {
console.error('Database error:', err);
return res.status(500).send('Internal Server Error');
}
res.send('User added successfully!');
});
});
// // Secure SQL query using parameterized queries
// app.post('/user', (req, res) => {
// const { username, email } = req.body;

// const query = 'INSERT INTO users (username, email) VALUES (?, ?)';
// connection.query(query, [username, email], (err, result) => {
// if (err) {
// console.error('Database error:', err);
// return res.status(500).send('Internal Server Error');
// }
// res.send('User added successfully!');
// });
// });