rules-backend

RISK: CORS wildcard (*) allows any origin to make credentialed cross-origin requests to this API — a broad exposure for APIs that use cookies or Authorization headers. FIX: Restrict to an explicit origin allowlist and set Access-Control-Allow-Credentials: false unless genuinely needed.

RISK: Hardcoded credential in source — secrets committed to VCS are recoverable from git history forever and weaponized within minutes of exposure (GitGuardian 2025). FIX: Load from environment variables (process.env / os.environ) or a secrets manager; never hard-code credentials.

RISK: File-system call using a value from request params/query/body without sanitization enables path traversal (CWE-22). An attacker can supply '../../etc/passwd' to read arbitrary files. FIX: Resolve the path with path.resolve(baseDir, userInput), verify the result starts with baseDir, and reject any path that escapes the allowed directory.

RISK: SQL query built by string concatenation is injectable (CWE-89). An attacker can manipulate the concatenated value to read/modify/drop any table the DB user can reach. FIX: Use parameterized queries — prisma, typeorm, or db.query('SELECT ... WHERE id = ?', [id]) — never build SQL with '+'.

RISK: Route file with state-mutating endpoints (POST/PUT/PATCH/DELETE) does not appear to import or reference any authentication or authorization middleware. Missing authz is the #1 API vulnerability (OWASP API3:2023). FIX: Apply an authentication guard to all non-public mutating routes and verify the caller's role/permissions before executing.

RISK: HTTP fetch/request using a URL derived from user input is a Server-Side Request Forgery (SSRF) vector (CWE-918) — an attacker can reach internal services (AWS IMDS, internal databases, localhost admin ports). FIX: Validate the URL against a strict allowlist of known-safe hosts before making the request; reject private IP ranges and localhost.

RISK: eval() / YAML.load() (without safeLoad) / pickle.load() execute arbitrary code when given untrusted input (CWE-502/CWE-94). FIX: Replace eval() with JSON.parse() or a safe expression evaluator; use YAML.safeLoad() / yaml.safe_load(); replace pickle with JSON or a schema-validated format.