Add bad code

[snyk-rfrazier]

No description provided.

[snyk-rfrazier]

⛔ Snyk checks have failed. 2 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (2)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
⛔	Code Security	0	1	1	0	2 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-rfrazier]

  NoSQL Injection

Unsanitized input from the HTTP request body flows into find, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 39 | CWE-943 | Priority score 807 | Learn more about this vulnerability

Data flow: 7 steps

Step 1 - 4

nodejs-goof/routes/index.js

Line 38 in fd6b80c

if (validator.isEmail(req.body.username)) {

Step 5 - 7

nodejs-goof/routes/index.js

Line 39 in fd6b80c

User.find({ username: req.body.username, password: req.body.password }, function (err, users) {

[snyk-rfrazier]

  Open Redirect

Unsanitized input from the HTTP request body flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability.

Line 61 | CWE-601 | Priority score 557 | Learn more about this vulnerability

Data flow: 9 steps

Step 1 - 5

nodejs-goof/routes/index.js

Line 41 in fd6b80c

const redirectPage = req.body.redirectPage

Step 6 routes/index.js#L44

Step 7 routes/index.js#L54

Step 8 - 9

nodejs-goof/routes/index.js

Line 61 in fd6b80c

return res.redirect(redirectPage)

---

Commands

• ⚡ To see AI-powered Snyk Agent Fix suggestions, reply with: @snyk /fix. You'll need to refresh the page 🔄