adding bad code

[snyk-rfrazier]

No description provided.

[snyk-rfrazier]

⛔ Snyk checks have failed. 2 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (2)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
⛔	Code Security	0	1	1	0	2 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-rfrazier]

  NoSQL Injection

Unsanitized input from the HTTP request body flows into find, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 39 | CWE-943 | Priority score 807 | Learn more about this vulnerability

Data flow: 7 steps

Step 1 - 4

nodejs-goof/routes/index.js

Line 38 in 578f96c

if (validator.isEmail(req.body.username)) {

Step 5 - 7

nodejs-goof/routes/index.js

Line 39 in 578f96c

User.find({ username: req.body.username, password: req.body.password }, function (err, users) {

[snyk-rfrazier]

  Open Redirect

Unsanitized input from the HTTP request body flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability.

Line 61 | CWE-601 | Priority score 557 | Learn more about this vulnerability

Data flow: 9 steps

Step 1 - 5

nodejs-goof/routes/index.js

Line 41 in 578f96c

const redirectPage = req.body.redirectPage

Step 6 routes/index.js#L44

Step 7 routes/index.js#L54

Step 8 - 9

nodejs-goof/routes/index.js

Line 61 in 578f96c

return res.redirect(redirectPage)

⚡ Fix this issue by replying with the following command: @snyk /fix