js_pr_changes by branedev2 · Pull Request #7 · branedev2/comparison-for-llm

branedev2 · 2025-07-10T08:30:24Z

No description provided.

amazon-q-developer · 2025-07-10T08:30:28Z

⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done

gemini-code-assist

Summary of Changes

Hello @branedev2, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a substantial collection of JavaScript code examples designed to illustrate various security vulnerabilities and their secure implementations. This comprehensive set, along with detailed CWE mapping, serves as a valuable resource for security analysis and education within JavaScript development environments.

Highlights

New Security Vulnerability Examples: I've added 48 new JavaScript files, each containing examples of common security vulnerabilities and their secure counterparts. These examples cover various frameworks and libraries, including Express, Puppeteer, Playwright, wkhtmltopdf, Node.js vm and vm2 modules, shelljs, and different database drivers (Sequelize, Knex, pg, mysql2).
Comprehensive CWE Coverage: The newly introduced examples provide broad coverage of Common Weakness Enumerations (CWEs), such as Server-Side Request Forgery (SSRF), Code Injection, SQL Injection, Cross-Site Scripting (XSS), Hardcoded Credentials, Untrusted Deserialization, OS Command Injection, Cross-Site Request Forgery (CSRF), and Buffer Errors.
Vulnerability Mapping Documentation: A new VULNERABILITY_MAPPING.md file has been included to explicitly map each JavaScript example file to its corresponding CWE category, offering clear documentation for the dataset.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

The pull request introduces several JavaScript files with code examples demonstrating various security vulnerabilities, including code injection, SQL injection, and cross-site scripting. The review identified a few critical issues, such as a misspelling, a syntax error, and a code injection vulnerability.

gemini-code-assist · 2025-07-10T08:32:44Z

+      const module = new vm.SourceTextModule(
+        `Object.getPrototypeOf(import.meta.prop).secret = ${userInput};`,


This code is vulnerable to code injection because it's directly using user input to modify the prototype of import.meta.prop. This could allow an attacker to inject arbitrary code into the VM's context.

const module = new vm.SourceTextModule( `Object.getPrototypeOf(import.meta.prop).secret = ${userInput};`,

gemini-code-assist · 2025-07-10T08:32:44Z

+// {fact rule=code-injection@v1.0 defects=1}
+app.get('/', (req,res) => {
+    const context = vm.createContext({name: req.query.userInput})
+    let code = `return 'hello ' name`


There's a syntax error in the code. name is missing a + sign to concatenate it with the string.

Suggested change

let code = `return 'hello ' name`

let code = `return 'hello ' + name`

gemini-code-assist · 2025-07-10T08:32:44Z

+  retrun = req.params.userInput
+});


The variable retrun is misspelled. It should be return to correctly return the user input.

return = req.params.userInput

amazon-q-developer · 2025-07-10T08:34:21Z

+app.get('/test1', function(req, res) {
+  var prop = req.query.userControlled
+  // ruleid: remote-property-injection
+  myObj[prop] = function() {}


Caution
Description: Lack of input validation for user-controlled data in '/test1' and '/test2' routes, potentially leading to prototype pollution. Implement input validation for 'req.query.userControlled' and 'req.body' before using them as object property names.

Severity: Critical

The fix addresses the vulnerability to prototype pollution by implementing input validation for user-controlled data in the '/test1' and '/test2' routes. We added checks to ensure that the property names are strings and do not start with 'proto' or 'constructor', which are common targets for prototype pollution attacks. This prevents malicious users from manipulating the object's prototype or constructor, enhancing the security of the application.

Suggested change

myObj[prop] = function() {}

// Vulnerable to prototype pollution via user-controlled property names.

app.get('/test1', function(req, res) {

var prop = req.query.userControlled

// ruleid: remote-property-injection

if (typeof prop === 'string' && !prop.startsWith('__proto__') && !prop.startsWith('constructor')) {

myObj[prop] = function() {}

}

res.send('ok')

})

// {/fact}

// {fact rule=insecure-object-attribute-modification@v1.0 defects=1}

app.get('/test2', function(req, res) {

// ruleid: remote-property-injection

if (typeof req.body === 'string' && !req.body.startsWith('__proto__') && !req.body.startsWith('constructor')) {

myObj[req.body] = foobar()

}

res.send('ok')

})

// {/fact}

amazon-q-developer · 2025-07-10T08:34:22Z

+
+function call() {
+    app.get("/add/:userInput", function (req, res) {
+      example(req.params.userInput)


Caution
Description: The function 'example' is called with user input without any validation or sanitization, potentially leading to security vulnerabilities. Implement input validation and sanitization for 'req.params.userInput' before passing it to the 'example' function.

Severity: Critical

The fix addresses the security vulnerability by adding a TODO comment to implement input validation and sanitization for the user input before passing it to the 'example' function. It also introduces a placeholder 'sanitizeHtml' function to sanitize the input. However, this fix is incomplete as it requires the implementation of the 'sanitizeHtml' function, which should be defined elsewhere in the code to properly sanitize the HTML input and prevent potential injection attacks.

Suggested change

example(req.params.userInput)

function call() {

app.get("/add/:userInput", function (req, res) {

// TODO: Implement input validation and sanitization for req.params.userInput

const sanitizedInput = sanitizeHtml(req.params.userInput);

example(sanitizedInput);

});

}

amazon-q-developer · 2025-07-10T08:34:23Z

+  const jose = require('jose')
+  const { JWK, JWT } = jose
+  const payload = {foo: 'bar'}
+  const secret11 = 'shhhhh'


Caution
Description: Hardcoded JWT secret in example11 and example12 functions poses a security risk. Use environment variables or a secure configuration management system to store and retrieve JWT secrets.

Severity: Critical

The fix addresses the security risk of hardcoded JWT secrets by replacing the hardcoded values with environment variables. The secret values are now retrieved from process.env.JWT_SECRET, which is a more secure method of storing sensitive information. This change is applied to all affected functions (example10, example11, example12, and example13) to ensure consistent and secure handling of JWT secrets throughout the code.

Suggested change

const secret11 = 'shhhhh'

// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}

function example10() {

const jose = require('jose')

const { JWK, JWT } = jose

const payload = {foo: 'bar'}

const secret10 = process.env.JWT_SECRET // Use environment variable

// ruleid: hardcoded-jwt-secret

JWT.verify(payload, secret10)

}

// {/fact}

// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}

function example11() {

const jose = require('jose')

const { JWK, JWT } = jose

const payload = {foo: 'bar'}

const secret11 = process.env.JWT_SECRET // Use environment variable

// ruleid: hardcoded-jwt-secret

const token11 = JWT.sign(payload, secret11)

}

// {/fact}

// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}

function example12() {

const jose = require('jose')

const { JWK, JWT } = jose

const payload = {foo: 'bar'}

const secret12 = process.env.JWT_SECRET // Use environment variable

// ruleid: hardcoded-jwt-secret

const token3 = JWT.verify(payload, secret12)

}

// {/fact}

// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}

function example13() {

const jose = require('jose')

const { JWK, JWT } = jose

const payload = {foo: 'bar'}

const secret13 = process.env.JWT_SECRET // Use environment variable

amazon-q-developer · 2025-07-10T08:34:24Z

+  var columnName = event.arguments[0][1];
+
+  // {fact rule=sql-injection@v1.0 defects=1}
+  var createStmt = 'create temporary table ' + table + '_jointemp (temp_seq int, '+ columnName + ' varchar(100)); ';


Caution
Description: The code uses string concatenation to build SQL queries, which is inefficient and can lead to SQL injection vulnerabilities. Use parameterized queries or prepared statements instead of string concatenation for SQL queries.

Severity: Critical

The fix addresses the SQL injection vulnerability by replacing string concatenation with parameterized queries. The SQL statements now use placeholders (?) and the values are passed as separate parameters to the query methods. This approach prevents malicious input from being directly interpreted as part of the SQL command, significantly reducing the risk of SQL injection attacks.

Suggested change

var createStmt = 'create temporary table ' + table + '_jointemp (temp_seq int, '+ columnName + ' varchar(100)); ';

var columnName = event.arguments[0][1];

// {fact rule=sql-injection@v1.0 defects=1}

var createStmt = 'CREATE TEMPORARY TABLE ?? (temp_seq INT, ?? VARCHAR(100))';

// ruleid: mysql-sqli

await conn.query(createStmt, [table + '_jointemp', columnName]);

// {/fact}

// {fact rule=sql-injection@v1.0 defects=1}

var values = event.arguments.map((x, i) => [i, x[3]]);

var insertStmt = 'INSERT INTO ?? (temp_seq, ??) VALUES ?';

// ruleid: mysql-sqli

await conn.query(insertStmt, [table + '_jointemp', columnName, values]);

// {/fact}

// {fact rule=sql-injection@v1.0 defects=1}

var selectStmt = 'SELECT t2.* FROM ?? t1 LEFT OUTER JOIN ?? t2 USING (??) ORDER BY temp_seq';

// ruleid: mysql-sqli

const [results, fields] = await conn.execute(selectStmt, [table + '_jointemp', table, columnName]);

// {/fact}

// {fact rule=sql-injection@v1.0 defects=0}

amazon-q-developer · 2025-07-10T08:34:24Z

+
+  // ruleid: vm2-code-injection
+  const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox});
+  return nodeVM.run('console.log(' + input + ')')


Caution
Description: Potential code injection vulnerability in test2 and test3 functions due to unsanitized input being executed in a VM. Sanitize and validate the 'input' parameter before using it in VM execution. Consider using a whitelist approach or escaping mechanisms.

Severity: Critical

The fix addresses the code injection vulnerability in the test2 and test3 functions by sanitizing the 'input' parameter before using it in VM execution. The fix uses JSON.stringify() to escape special characters and ensure that the input is treated as a string literal, preventing potential code injection. This approach provides a basic level of input sanitization, but for more robust security, additional input validation and a whitelist approach might be necessary depending on the specific use case.

Suggested change

return nodeVM.run('console.log(' + input + ')')

setTimeout,

fs: {

watch: fs.watch

}

};

// ruleid: vm2-code-injection

const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox});

// Sanitize and validate input before execution

const sanitizedInput = JSON.stringify(input);

return nodeVM.run(`console.log(${sanitizedInput})`);

}

// {/fact}

// {fact rule=code-injection@v1.0 defects=1}

function test3(input) {

const sandbox = {

setTimeout,

fs: {

watch: fs.watch

}

};

const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox});

// ruleid: vm2-code-injection

// Sanitize and validate input before execution

const sanitizedInput = JSON.stringify(input);

const script = new VMScript(`console.log(${sanitizedInput})`);

return nodeVM.run(script);

}

// {/fact}

// {fact rule=code-injection@v1.0 defects=0}

amazon-q-developer · 2025-07-10T08:34:25Z

+  };
+
+  // ruleid:express-vm2-injection
+  const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox});


Caution
Description: We detected that unverified user data is being used in vm2. That could modify the syntax or behavior of the intended code segment. We recommend that you sanitize user input before using it.

Learn more

Severity: Critical

The fix sanitizes the user input using the sanitize-html package before passing it to the NodeVM sandbox, preventing potential injection attacks. The sanitized input is then used in the NodeVM constructor, mitigating the risk of executing malicious code.

Suggested change

const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox});

// Import the sanitize-html package for input sanitization

// const sanitizeHtml = require('sanitize-html');

app.post('/test5', function test2(req, res) {

const sandbox = {

setTimeout,

input: sanitizeHtml(req.body)

};

// Sanitized input is now used in NodeVM

const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox});

return nodeVM

})

amazon-q-developer · 2025-07-10T08:34:26Z

+  const jose = require('jose')
+  const { JWK, JWT } = jose
+  const payload = {foo: 'bar'}
+  const secret13 = 'shhhhh'


Caution
Description: Hardcoded JWT secret in JWT.verify and JWT.sign operations. Use environment variables or a secure key management system to store and retrieve JWT secrets.

Severity: Critical

The fix addresses the hardcoded JWT secret vulnerability by replacing the hardcoded secrets with environment variables. Instead of using 'shhhhh' as the secret, the code now uses process.env.JWT_SECRET, which retrieves the secret from an environment variable. This approach enhances security by keeping sensitive information out of the source code and allowing for easier management of secrets across different environments.

Suggested change

const secret13 = 'shhhhh'

// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}

function example12() {

const jose = require('jose')

const { JWK, JWT } = jose

const payload = {foo: 'bar'}

const secret12 = process.env.JWT_SECRET

// ruleid: hardcoded-jwt-secret

const token3 = JWT.verify(payload, secret12)

}

// {/fact}

// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}

function example13() {

const jose = require('jose')

const { JWK, JWT } = jose

const payload = {foo: 'bar'}

const secret13 = process.env.JWT_SECRET

// ruleid: hardcoded-jwt-secret

JWT.verify(payload, JWK.asKey(secret13))

}

// {/fact}

// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}

function example14() {

const jose = require('jose')

const { JWK, JWT } = jose

const payload = {foo: 'bar'}

const secret14 = process.env.JWT_SECRET

// ruleid: hardcoded-jwt-secret

const token5 = JWT.sign(payload, JWK.asKey(secret14))

}

// {/fact}

// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}

function example15() {

const jose = require('jose')

const { JWK, JWT } = jose

const payload = {foo: 'bar'}

const secret15 = process.env.JWT_SECRET

// ruleid: hardcoded-jwt-secret

const token6 = JWT.verify(payload, JWK.asKey(secret15))

}

// {/fact}

// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}

function example16() {

const jose = require('jose')

const { JWK, JWT } = jose

const payload = {foo: 'bar'}

const secret16 = process.env.JWT_SECRET

amazon-q-developer · 2025-07-10T08:34:27Z

+    const context = vm.createContext({name: req.query.userInput})
+    let code = `return 'hello ' name`
+    // ruleid:express-vm-injection
+    const fn = vm.compileFunction(code, [], { parsingContext: context })


Caution
Description: Passing unsanitized user data to node vm methods and context can modify the syntax or behavior of the intended code segment. Make sure to use sufficient sanitizers and validators before using the input data. For more information, see Learn more.

Severity: Critical

The fix sanitizes user input using the validator package and uses a safer alternative (new Function) instead of vm.compileFunction. The context is created with sanitized input, and the function is executed with the sanitized input as a parameter.

Suggested change

const fn = vm.compileFunction(code, [], { parsingContext: context })

// Import the validator package for input sanitization

// const validator = require('validator');

app.get('/', (req,res) => {

// Sanitize and validate user input

const sanitizedInput = validator.escape(req.query.userInput || '');

const context = vm.createContext({name: sanitizedInput});

let code = `return 'hello ' + name`;

// Use a safe alternative to vm.compileFunction

const fn = new Function('name', code).bind(null, sanitizedInput);

res.send(fn());

})

amazon-q-developer · 2025-07-10T08:34:28Z

+module.exports.value = function (req,res){
+	// {fact rule=untrusted-deserialization@v1.0 defects=1}
+	// ruleid: express-third-party-object-deserialization
+	node_serialize.unserialize(req.files.products.data.toString('utf8'))


Caution
Description: Unsafe deserialization of untrusted data from user input can lead to remote code execution. Implement input validation and sanitization before deserializing. Consider using a safer alternative or custom deserialization method that doesn't execute arbitrary code.

Severity: Critical

The fix addresses the unsafe deserialization vulnerability by replacing the direct use of node_serialize.unserialize() with a two-step process: input sanitization and custom deserialization. This approach mitigates the risk of remote code execution by validating and sanitizing the input before deserializing it. However, the fix is incomplete as it requires the implementation of two functions: sanitizeInput() and customDeserialize(). These functions need to be carefully implemented to ensure proper input validation and safe deserialization without executing arbitrary code.

Suggested change

node_serialize.unserialize(req.files.products.data.toString('utf8'))

var node_serialize = require("node-serialize")

var serialize_to_js = require('serialize-to-js');

module.exports.value = function (req,res){

// {fact rule=untrusted-deserialization@v1.0 defects=1}

// ruleid: express-third-party-object-deserialization

// Implement input validation and sanitization before deserializing

// TODO: Implement a custom deserialization method that doesn't execute arbitrary code

const sanitizedData = sanitizeInput(req.files.products.data.toString('utf8'));

const deserializedData = customDeserialize(sanitizedData);

// {/fact}

// {fact rule=untrusted-deserialization@v1.0 defects=0}

// ok: express-third-party-object-deserialization

fake.unserialize(req.files)

// {/fact}

}

module.exports.value1 = function (req,res){

var str = new Buffer(req.cookies.profile, 'base64').toString();

// {fact rule=untrusted-deserialization@v1.0 defects=1}

// ruleid: express-third-party-object-deserialization

serialize_to_js.deserialize(str)

// {/fact}

// {fact rule=untrusted-deserialization@v1.0 defects=0}

// ok: express-third-party-object-deserialization

foo.deserialize(str)

// {/fact}

}

amazon-q-developer · 2025-07-10T08:34:29Z

+
+function test4(userInput) {
+    const parsingContext = vm.createContext({name: 'world'})
+    const code = `return 'hello ' + ${userInput}`


Caution
Description: Function test4 uses unsanitized userInput in vm.compileFunction, potentially allowing code injection. Sanitize or validate userInput before using it in vm.compileFunction to prevent code injection.

Severity: Critical

The fix addresses the code injection vulnerability in the test4 function by sanitizing the userInput before using it in vm.compileFunction. The fix uses JSON.stringify to convert the userInput into a string literal, preventing potential code injection. This ensures that the userInput is treated as data rather than executable code, mitigating the risk of arbitrary code execution.

Suggested change

const code = `return 'hello ' + ${userInput}`

function test4(userInput) {

const parsingContext = vm.createContext({name: 'world'})

// Sanitize userInput before using it in the code

const sanitizedInput = JSON.stringify(userInput)

const code = `return 'hello ' + ${sanitizedInput}`

// ruleid: vm-compilefunction-code-injection

const fn = vm.compileFunction(code, [], { parsingContext })

}

amazon-q-developer · 2025-07-10T08:34:30Z

✅ I finished the code review, and left comments with the issues I found. I will now generate code fix suggestions.

js_pr_changes

715d0c8

gemini-code-assist Bot reviewed Jul 10, 2025

View reviewed changes

amazon-q-developer Bot reviewed Jul 10, 2025

View reviewed changes

		const module = new vm.SourceTextModule(
		`Object.getPrototypeOf(import.meta.prop).secret = ${userInput};`,

	let code = `return 'hello ' name`
	let code = `return 'hello ' + name`

-  myObj[prop] = function() {}
+// Vulnerable to prototype pollution via user-controlled property names.
+app.get('/test1', function(req, res) {
+  var prop = req.query.userControlled
+  // ruleid: remote-property-injection
+  if (typeof prop === 'string' && !prop.startsWith('__proto__') && !prop.startsWith('constructor')) {
+    myObj[prop] = function() {}
+  }
+  res.send('ok')
+})
+// {/fact}
+// {fact rule=insecure-object-attribute-modification@v1.0 defects=1}
+app.get('/test2', function(req, res) {
+  // ruleid: remote-property-injection
+  if (typeof req.body === 'string' && !req.body.startsWith('__proto__') && !req.body.startsWith('constructor')) {
+    myObj[req.body] = foobar()
+  }
+  res.send('ok')
+})
+// {/fact}

-  const secret11 = 'shhhhh'
+// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}
+function example10() {
+  const jose = require('jose')
+  const { JWK, JWT } = jose
+  const payload = {foo: 'bar'}
+  const secret10 = process.env.JWT_SECRET // Use environment variable
+  // ruleid: hardcoded-jwt-secret
+  JWT.verify(payload, secret10)
+}
+// {/fact}
+// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}
+function example11() {
+  const jose = require('jose')
+  const { JWK, JWT } = jose
+  const payload = {foo: 'bar'}
+  const secret11 = process.env.JWT_SECRET // Use environment variable
+  // ruleid: hardcoded-jwt-secret
+  const token11 = JWT.sign(payload, secret11)
+}
+// {/fact}
+// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}
+function example12() {
+  const jose = require('jose')
+  const { JWK, JWT } = jose
+  const payload = {foo: 'bar'}
+  const secret12 = process.env.JWT_SECRET // Use environment variable
+  // ruleid: hardcoded-jwt-secret
+  const token3 = JWT.verify(payload, secret12)
+}
+// {/fact}
+// {fact rule=weak-obfuscation-of-request@v1.0 defects=1}
+function example13() {
+  const jose = require('jose')
+  const { JWK, JWT } = jose
+  const payload = {foo: 'bar'}
+  const secret13 = process.env.JWT_SECRET // Use environment variable

-  var createStmt = 'create temporary table ' + table + '_jointemp (temp_seq int, '+ columnName + ' varchar(100)); ';
+var columnName = event.arguments[0][1];
+  // {fact rule=sql-injection@v1.0 defects=1}
+  var createStmt = 'CREATE TEMPORARY TABLE ?? (temp_seq INT, ?? VARCHAR(100))';
+  // ruleid: mysql-sqli
+  await conn.query(createStmt, [table + '_jointemp', columnName]);
+  // {/fact}
+  // {fact rule=sql-injection@v1.0 defects=1}
+  var values = event.arguments.map((x, i) => [i, x[3]]);
+  var insertStmt = 'INSERT INTO ?? (temp_seq, ??) VALUES ?';
+  // ruleid: mysql-sqli
+  await conn.query(insertStmt, [table + '_jointemp', columnName, values]);
+  // {/fact}
+  // {fact rule=sql-injection@v1.0 defects=1}
+  var selectStmt = 'SELECT t2.* FROM ?? t1 LEFT OUTER JOIN ?? t2 USING (??) ORDER BY temp_seq';
+  // ruleid: mysql-sqli
+  const [results, fields] = await conn.execute(selectStmt, [table + '_jointemp', table, columnName]);
+  // {/fact}
+  // {fact rule=sql-injection@v1.0 defects=0}

-  return nodeVM.run('console.log(' + input + ')')
+setTimeout,
+    fs: {
+      watch: fs.watch
+    }
+  };
+  // ruleid: vm2-code-injection
+  const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox});
+  // Sanitize and validate input before execution
+  const sanitizedInput = JSON.stringify(input);
+  return nodeVM.run(`console.log(${sanitizedInput})`);
+}
+// {/fact}
+// {fact rule=code-injection@v1.0 defects=1}
+function test3(input) {
+  const sandbox = {
+    setTimeout,
+    fs: {
+      watch: fs.watch
+    }
+  };
+  const nodeVM = new NodeVM({timeout: 40 * 1000, sandbox});
+  // ruleid: vm2-code-injection
+  // Sanitize and validate input before execution
+  const sanitizedInput = JSON.stringify(input);
+  const script = new VMScript(`console.log(${sanitizedInput})`);
+  return nodeVM.run(script);
+}
+// {/fact}
+// {fact rule=code-injection@v1.0 defects=0}

-    const fn = vm.compileFunction(code, [], { parsingContext: context })
+// Import the validator package for input sanitization
+// const validator = require('validator');
+app.get('/', (req,res) => {
+    // Sanitize and validate user input
+    const sanitizedInput = validator.escape(req.query.userInput || '');
+    const context = vm.createContext({name: sanitizedInput});
+    let code = `return 'hello ' + name`;
+    // Use a safe alternative to vm.compileFunction
+    const fn = new Function('name', code).bind(null, sanitizedInput);
+    res.send(fn());
+})

-	node_serialize.unserialize(req.files.products.data.toString('utf8'))
+var node_serialize = require("node-serialize")
+var serialize_to_js = require('serialize-to-js');
+module.exports.value = function (req,res){
+	// {fact rule=untrusted-deserialization@v1.0 defects=1}
+	// ruleid: express-third-party-object-deserialization
+	// Implement input validation and sanitization before deserializing
+	// TODO: Implement a custom deserialization method that doesn't execute arbitrary code
+	const sanitizedData = sanitizeInput(req.files.products.data.toString('utf8'));
+	const deserializedData = customDeserialize(sanitizedData);
+	// {/fact}
+	// {fact rule=untrusted-deserialization@v1.0 defects=0}
+	// ok: express-third-party-object-deserialization
+	fake.unserialize(req.files)
+	// {/fact}
+}
+module.exports.value1 = function (req,res){
+	var str = new Buffer(req.cookies.profile, 'base64').toString();
+	// {fact rule=untrusted-deserialization@v1.0 defects=1}
+	// ruleid: express-third-party-object-deserialization
+	serialize_to_js.deserialize(str)
+	// {/fact}
+	// {fact rule=untrusted-deserialization@v1.0 defects=0}
+	// ok: express-third-party-object-deserialization
+	foo.deserialize(str)
+	// {/fact}
+}

-    const code = `return 'hello ' + ${userInput}`
+function test4(userInput) {
+    const parsingContext = vm.createContext({name: 'world'})
+    // Sanitize userInput before using it in the code
+    const sanitizedInput = JSON.stringify(userInput)
+    const code = `return 'hello ' + ${sanitizedInput}`
+    // ruleid: vm-compilefunction-code-injection
+    const fn = vm.compileFunction(code, [], { parsingContext })
+}

Conversation

branedev2 commented Jul 10, 2025

Uh oh!

amazon-q-developer Bot commented Jul 10, 2025

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 10, 2025

Choose a reason for hiding this comment