bodyParser() POST Request to Express Body Parser 'bodyParser()' can create Temporary files and consume space. module handlebars.SafeString( Handlebars SafeString will not escape the data passed through it. Untrusted user input passing through SafeString can cause XSS. module (eval\()(.{0,40000})(req\.|req\.query|req\.body|req\.param) User controlled data in eval() can result in Server Side Injection (SSI) or Remote Code Execution (RCE). rci (setTimeout\()(.{0,40000})(req\.|req\.query|req\.body|req\.param) User controlled data in 'setTimeout()' can result in Server Side Injection (SSI) or Remote Code Execution (RCE). rci (setInterval\()(.{0,40000})(req\.|req\.query|req\.body|req\.param) User controlled data in 'setInterval()' can result in Server Side Injection (SSI) or Remote Code Execution (RCE). rci (new Function\()(.{0,40000})(req\.|req\.query|req\.body|req\.param) User controlled data in 'new Function()' can result in Server Side Injection (SSI) or Remote Code Execution (RCE). rci (deserialize\(|unserialize\() User controlled data in 'unserialize()' or 'deserialize()' function can result in Object Injection or Remote Code Injection. rci (require\('js-yaml'\)\.load\(|yaml\.load\() User controlled data in 'load()' function can result in Remote Code Injection. rci (\[)*('|")*NODE_TLS_REJECT_UNAUTHORIZED('|")*(\])*(\s)*=(\s)*('|")*0('|")* 'Setting 'NODE_TLS_REJECT_UNAUTHORIZED' to 0 will allow node server to accept self signed certificates and is not an secure behaviour. node noEscape(\s)*:(\s)*true Disabling Escaping Handlebars is not a secure behaviour. module SSL_VERIFYPEER(\s)*:(\s)*0 SSL Certificate verification for node-curl is disabled. node createHash\(('|")md5('|") MD5 is a a weak hash which is known to have collision. Use a strong hashing function. node createHash\(('|")sha1('|") SHA1 is a a weak hash which is known to have collision. Use a strong hashing function. node password\s*=\s*['|"].+['|"]\s{0,5}[;|.] A hardcoded password in plain text was identified. node \s*['|\"]password['|\"]\s*: A hardcoded password in plain text was identified. node \s*['|\"]+secret['|\"]+\s*:|\s*secret\s*:\s*['|\"]+ A hardcoded secret was identified. node username\s*=\s*['|"].+['|"]\s{0,5}[;|.] A hardcoded username in plain text was identified. Store it properly in a config file. node lusca.xssProtection\(false\)|X-XSS-Protection('|")*(\s)*(:|,)(\s)*('|")*0 X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter. node (\.createReadStream\()(.{0,40000})(req\.|req\.query|req\.body|req\.param) Untrusted user input in createReadStream() can endup in Directory Traversal Attacks dir (\.readFile\()(.{0,40000})(req\.|req\.query|req\.body|req\.param) Untrusted user input in readFile() can endup in Directory Traversal Attacks dir (res\.redirect\()( *)(req\.|req\.query|req\.body|req\.param) Untrusted user input in redirect() can result in Open Redirect vulnerability opr (SELECT|INSERT|UPDATE|DELETE|CREATE|EXPLAIN)(.{0,40000})(req\.|req\.query|req\.body|req\.param) Untrusted User Input in RAW SQL Query can cause SQL Injection sqli (\.)(find|drop|create|explain|delete|count|bulk|copy)(.{0,4000})({(.{0,4000})\$where:)(.{0,4000})(req\.|req\.query|req\.body|req\.param) Untrusted User Input in Vulnerable Mongo DB functions can cause NoSQLi JavaScript Injection nosqli (res\.(write|send)\()(.{0,40000})(req\.|req\.query|req\.body|req\.param) Untrusted User Input in Response will result in Reflected Cross Site Scripting Vulnerability xss (res\.set\()(.{0,40000})(req\.|req\.query|req\.body|req\.param) Untrusted user input in set() will result in HTTP Header Injection or Splitting Attacks hhi {{{\s*[\w.\[\]\(\)]+\s*}}} The Handlebar.js/Mustache.js template has an unescaped variable. Untrusted user input passed to this variable results in Cross Site Scripting (XSS). xss {\s*[\w.\[\]\(\)]+\s*\|\s*s\s*} The Dust.js template has an unescaped variable. Untrusted user input passed to this variable results in Cross Site Scripting (XSS). xss #{\s*[\w.\[\]\(\)\'\"]+\s*} The Pug.js template has an unescaped variable. Untrusted user input passed to this variable results in Cross Site Scripting (XSS). xss <%-\s*[\w.\[\]\(\)]+\s*%> The EJS template has an unescaped variable. Untrusted user input passed to this variable results in Cross Site Scripting (XSS). xss <%-\s*@+[\w.\[\]\(\)]+\s*%> The ECT template has an unescaped variable. Untrusted user input passed to this variable results in Cross Site Scripting (XSS). xss require( )*(\()( *)('|")child_process('|")( *)(\)) (\.exec\()(.{0,40000})(req\.|req\.query|req\.body|req\.param) User controlled data in 'child_process.exec()' can result in Remote OS Command Execution. rce require( )*(\()( *)('|")request('|")( *)(\)) (\()(.*?)(req\.|req\.query|req\.body|req\.param) User controlled data in 'request()' can result in Server Side Request Forgery (SSRF). ssrf require( )*(\()( *)('|")request('|")( *)(\)) \.get( *)(\()(.*?)(req\.|req\.query|req\.body|req\.param) User controlled data in 'request.get()' can result in Server Side Request Forgery (SSRF). ssrf require( )*(\()( *)('|")needle('|")( *)(\)) \.get( *)(\()(.*?)(req\.|req\.query|req\.body|req\.param) User controlled data in 'needle.get()' can result in Server Side Request Forgery (SSRF). ssrf require\(('|")helmet-csp('|")\)|helmet.csp|lusca.csp\(|Content-Security-Policy Content Security Policy (CSP), a mechanism web applications can use to mitigate a broad class of content injection vulnerabilities, such as cross-site scripting (XSS). CSP Header was not found. web helmet.xframe|lusca.xframe\(|require\(('|")frameguard('|")\)|frameguard\(|X-Frame-Options X-Frame-Options (XFO) header provides protection against Clickjacking attacks. web helmet.hsts\({|lusca.hsts\({|hsts\({|require\(('|")hsts('|")\)|Strict-Transport-Security Strict-Transport-Security (HSTS) header enforces secure (HTTP over SSL/TLS) connections to the server. web Public-Key-Pins(:|,)* Public-Key-Pins (HPKP) ensures that certificate is Pinned. web helmet.xssFilter\(\)|lusca.xssProtection\(true\)|X-XSS-Protection('|")*(\s)*(:|,)(\s)*('|")*1 X-XSS-Protection header set to 1 enables the Cross-site scripting (XSS) filter built into most recent web browsers. web helmet.noSniff|require\(('|")dont-sniff-mimetype('|")\)|nosniff\(\)|X-Content-Type-Options('|")*(\s)*(:|,)(\s)*('\"")*nosniff X-Content-Type-Options header prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. web require\(('|")ienoopen('|")\)|ienoopen\(|helmet.ienoopen\(|X-Download-Options('|")*(\s)*(:|,)(\s)*('\"")*noopen X-Download-Options header set to noopen prevents IE users from directly opening and executing downloads in your site's context. web httpOnly(\s)*:(\s)*true|httpOnly JavaScript can access Cookies if they are not marked httpOnly. web .disable\(('|")x-powered-by('|")\)|require\(('|")hide-powered-by('|")\)|hidePoweredBy\(|helmet.hidePoweredBy\(|removeHeader\(('|")X-Powered-By('|")\) Remove the X-Powered-By header to prevent information gathering. web ("|')use strict("|'); Strict Mode allows you to place a program, or a function, in a "strict" operating context. This strict context prevents certain actions from being taken and throws more exceptions. node