From 4dcfb5792586be68379e0b5fb58453139b35dc3e Mon Sep 17 00:00:00 2001 From: anupamme Date: Mon, 28 Sep 2026 00:28:00 +0000 Subject: [PATCH] fix: multi_agent.cwe-798 security vulnerability Automated security fix generated by OrbisAI Security --- analyzer/lib/databases/checkDASHardCodedValues.js | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/analyzer/lib/databases/checkDASHardCodedValues.js b/analyzer/lib/databases/checkDASHardCodedValues.js index 110ace8..a0e499b 100644 --- a/analyzer/lib/databases/checkDASHardCodedValues.js +++ b/analyzer/lib/databases/checkDASHardCodedValues.js @@ -38,12 +38,12 @@ "min_length": 8 }, "customScripts": { - "login": "function login(identifierValue, password, callback) {\n const mysql = require('mysql');\n const bcrypt = require('bcrypt');\n\n const connection = mysql.createConnection({\n host: 'localhost',\n user: 'me',\n password: 'secret',\n database: 'mydb'\n });\n\n connection.connect();\n\n const query = 'SELECT id, nickname, email, password FROM users WHERE email = ?';\n\n connection.query(query, [ identifierValue ], function(err, results) {\n if (err) return callback(err);\n if (results.length === 0) return callback(new WrongUsernameOrPasswordError(identifierValue));\n const user = results[0];\n\n bcrypt.compare(password, user.password, function(err, isValid) {\n if (err || !isValid) return callback(err || new WrongUsernameOrPasswordError(identifierValue));\n\n callback(null, {\n user_id: user.id.toString(),\n nickname: user.nickname,\n email: user.email\n });\n });\n });\n}\n", - "create": "function create(user, callback) {\n const mysql = require('mysql');\n const bcrypt = require('bcrypt');\n\n const connection = mysql.createConnection({\n host: 'localhost',\n user: 'me',\n password: 'secret',\n database: 'mydb'\n });\n\n connection.connect();\n\n const query = 'INSERT INTO users SET ?';\n\n bcrypt.hash(user.password, 10, function(err, hash) {\n if (err) return callback(err);\n\n const insert = {\n password: hash,\n email: user.email\n };\n\n connection.query(query, insert, function(err, results) {\n if (err) return callback(err);\n if (results.length === 0) return callback();\n callback(null);\n });\n });\n}\n", + "login": "function login(identifierValue, password, callback) {\n const mysql = require('mysql');\n const bcrypt = require('bcrypt');\n\n const connection = mysql.createConnection({\n host: 'localhost',\n user: process.env.DB_USER,\n password: process.env.DB_PASSWORD,\n database: 'mydb'\n });\n\n connection.connect();\n\n const query = 'SELECT id, nickname, email, password FROM users WHERE email = ?';\n\n connection.query(query, [ identifierValue ], function(err, results) {\n if (err) return callback(err);\n if (results.length === 0) return callback(new WrongUsernameOrPasswordError(identifierValue));\n const user = results[0];\n\n bcrypt.compare(password, user.password, function(err, isValid) {\n if (err || !isValid) return callback(err || new WrongUsernameOrPasswordError(identifierValue));\n\n callback(null, {\n user_id: user.id.toString(),\n nickname: user.nickname,\n email: user.email\n });\n });\n });\n}\n", + "create": "function create(user, callback) {\n const mysql = require('mysql');\n const bcrypt = require('bcrypt');\n\n const connection = mysql.createConnection({\n host: 'localhost',\n user: process.env.DB_USER,\n password: process.env.DB_PASSWORD,\n database: 'mydb'\n });\n\n connection.connect();\n\n const query = 'INSERT INTO users SET ?';\n\n bcrypt.hash(user.password, 10, function(err, hash) {\n if (err) return callback(err);\n\n const insert = {\n password: hash,\n email: user.email\n };\n\n connection.query(query, insert, function(err, results) {\n if (err) return callback(err);\n if (results.length === 0) return callback();\n callback(null);\n });\n });\n}\n", "delete": "function remove(id, callback) {\n // This script remove a user from your existing database.\n // It is executed whenever a user is deleted from the API or Auth0 dashboard.\n //\n // There are two ways that this script can finish:\n // 1. The user was removed successfully:\n // callback(null);\n // 2. Something went wrong while trying to reach your database:\n // callback(new Error(\"my error message\"));\n\n const msg = 'Please implement the Delete script for this database ' +\n 'connection at https://manage.auth0.com/#/connections/database';\n return callback(new Error(msg));\n}\n", - "verify": "function verify(email, callback) {\n const mysql = require('mysql');\n\n const connection = mysql.createConnection({\n host: 'localhost',\n user: 'me',\n password: 'secret',\n database: 'mydb'\n });\n\n connection.connect();\n\n const query = 'UPDATE users SET email_Verified = true WHERE email_Verified = false AND email = ?';\n\n connection.query(query, [ email ], function(err, results) {\n if (err) return callback(err);\n\n callback(null, results.length > 0);\n });\n\n}\n", - "get_user": "function getUser(identifierValue, callback) {\n const mysql = require('mysql');\n\n const connection = mysql.createConnection({\n host: 'localhost',\n user: 'me',\n password: 'secret',\n database: 'mydb'\n });\n\n connection.connect();\n\n const query = 'SELECT id, nickname, email FROM users WHERE email = ?';\n\n connection.query(query, [ identifierValue ], function(err, results) {\n if (err || results.length === 0) return callback(err || null);\n\n const user = results[0];\n callback(null, {\n user_id: user.id.toString(),\n nickname: user.nickname,\n email: user.email\n });\n });\n}\n", - "change_password": "function changePassword(email, newPassword, callback) {\n const mysql = require('mysql');\n const bcrypt = require('bcrypt');\n\n const connection = mysql.createConnection({\n host: 'localhost',\n user: 'me',\n password: 'secret',\n database: 'mydb'\n });\n\n connection.connect();\n\n const query = 'UPDATE users SET password = ? WHERE email = ?';\n\n bcrypt.hash(newPassword, 10, function(err, hash) {\n if (err) return callback(err);\n\n connection.query(query, [ hash, email ], function(err, results) {\n if (err) return callback(err);\n callback(null, results.length > 0);\n });\n });\n}\n" + "verify": "function verify(email, callback) {\n const mysql = require('mysql');\n\n const connection = mysql.createConnection({\n host: 'localhost',\n user: process.env.DB_USER,\n password: process.env.DB_PASSWORD,\n database: 'mydb'\n });\n\n connection.connect();\n\n const query = 'UPDATE users SET email_Verified = true WHERE email_Verified = false AND email = ?';\n\n connection.query(query, [ email ], function(err, results) {\n if (err) return callback(err);\n\n callback(null, results.length > 0);\n });\n\n}\n", + "get_user": "function getUser(identifierValue, callback) {\n const mysql = require('mysql');\n\n const connection = mysql.createConnection({\n host: 'localhost',\n user: process.env.DB_USER,\n password: process.env.DB_PASSWORD,\n database: 'mydb'\n });\n\n connection.connect();\n\n const query = 'SELECT id, nickname, email FROM users WHERE email = ?';\n\n connection.query(query, [ identifierValue ], function(err, results) {\n if (err || results.length === 0) return callback(err || null);\n\n const user = results[0];\n callback(null, {\n user_id: user.id.toString(),\n nickname: user.nickname,\n email: user.email\n });\n });\n}\n", + "change_password": "function changePassword(email, newPassword, callback) {\n const mysql = require('mysql');\n const bcrypt = require('bcrypt');\n\n const connection = mysql.createConnection({\n host: 'localhost',\n user: process.env.DB_USER,\n password: process.env.DB_PASSWORD,\n database: 'mydb'\n });\n\n connection.connect();\n\n const query = 'UPDATE users SET password = ? WHERE email = ?';\n\n bcrypt.hash(newPassword, 10, function(err, hash) {\n if (err) return callback(err);\n\n connection.query(query, [ hash, email ], function(err, results) {\n if (err) return callback(err);\n callback(null, results.length > 0);\n });\n });\n}\n" }, "enabledDatabaseCustomization": true,