From 89ff4b96b10e43aa402b9b2b7d6ad8173962888c Mon Sep 17 00:00:00 2001
From: fhaubner <5937492+fhaubner@users.noreply.github.com>
Date: Tue, 1 Sep 2026 12:41:35 +0000
Subject: [PATCH] fix(security): CodeMender autonomous remediation

Patches generated by `cm fix` for the top 3 HIGH/CRITICAL finding(s).
---
 routes/login.ts       |  3 +--
 routes/search.ts      |  2 +-
 routes/userProfile.ts | 15 +--------------
 3 files changed, 3 insertions(+), 17 deletions(-)

diff --git a/routes/login.ts b/routes/login.ts
index fb9fce3..1a5c42a 100755
--- a/routes/login.ts
+++ b/routes/login.ts
@@ -10,7 +10,6 @@ import { challenges, users } from '../data/datacache'
 import { BasketModel } from '../models/basket'
 import * as security from '../lib/insecurity'
 import { UserModel } from '../models/user'
-import * as models from '../models/index'
 import { type User } from '../data/types'
 import * as utils from '../lib/utils'
 
@@ -31,7 +30,7 @@ export function login () {
 
   return (req: Request, res: Response, next: NextFunction) => {
     verifyPreLoginChallenges(req) // vuln-code-snippet hide-line
-    models.sequelize.query(`SELECT * FROM Users WHERE email = '${req.body.email || ''}' AND password = '${security.hash(req.body.password || '')}' AND deletedAt IS NULL`, { model: UserModel, plain: true }) // vuln-code-snippet vuln-line loginAdminChallenge loginBenderChallenge loginJimChallenge
+    UserModel.findOne({ where: { email: req.body.email || '', password: security.hash(req.body.password || '') } })
       .then((authenticatedUser) => { // vuln-code-snippet neutral-line loginAdminChallenge loginBenderChallenge loginJimChallenge
         const user = utils.queryResultToJson(authenticatedUser)
         if (user.data?.id && user.data.totpSecret !== '') {
diff --git a/routes/search.ts b/routes/search.ts
index 07d0fcd..41b5a3e 100755
--- a/routes/search.ts
+++ b/routes/search.ts
@@ -20,7 +20,7 @@ export function searchProducts () {
   return (req: Request, res: Response, next: NextFunction) => {
     let criteria: any = req.query.q === 'undefined' ? '' : req.query.q ?? ''
     criteria = (criteria.length <= 200) ? criteria : criteria.substring(0, 200)
-    models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`) // vuln-code-snippet vuln-line unionSqlInjectionChallenge dbSchemaChallenge
+    models.sequelize.query('SELECT * FROM Products WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL) ORDER BY name', { replacements: { criteria: `%${criteria}%` } }) // vuln-code-snippet vuln-line unionSqlInjectionChallenge dbSchemaChallenge
       .then(([products]: any) => {
         const dataString = JSON.stringify(products)
         if (challengeUtils.notSolved(challenges.unionSqlInjectionChallenge)) { // vuln-code-snippet hide-start
diff --git a/routes/userProfile.ts b/routes/userProfile.ts
index af2c108..3469cdd 100755
--- a/routes/userProfile.ts
+++ b/routes/userProfile.ts
@@ -51,20 +51,7 @@ export function getUserProfile () {
 
     let username = user.username
 
-    if (username?.match(/#{(.*)}/) !== null && utils.isChallengeEnabled(challenges.usernameXssChallenge)) {
-      req.app.locals.abused_ssti_bug = true
-      const code = username?.substring(2, username.length - 1)
-      try {
-        if (!code) {
-          throw new Error('Username is null')
-        }
-        username = eval(code) // eslint-disable-line no-eval
-      } catch (err) {
-        username = '\\' + username
-      }
-    } else {
-      username = '\\' + username
-    }
+    username = '\\' + username
 
     const themeKey = config.get<string>('application.theme') as keyof typeof themes
     const theme = themes[themeKey] || themes['bluegrey-lightgreen']