-
Notifications
You must be signed in to change notification settings - Fork 0
test: rules_paths enforcement - intentional violations #9
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,58 @@ | ||||||
| var express = require('express'); | ||||||
| var router = express.Router(); | ||||||
|
|
||||||
| var categories = []; | ||||||
| var nextId = 1; | ||||||
|
|
||||||
| // get all categories | ||||||
| router.get('/', function(req, res) { | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [HIGH] quality: Missing error handling in GET /categories route The route handler for There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [MEDIUM] architecture: Missing pagination for list endpoint The |
||||||
| res.json(categories); | ||||||
| }); | ||||||
|
|
||||||
| // get single category | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [HIGH] quality: Missing error handling in GET /categories/:id route The route handler for |
||||||
| router.get('/:id', function(req, res) { | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [MEDIUM] correctness: Use strict equality Using Suggestion:
Suggested change
|
||||||
| var category = categories.find(function(c) { return c.id == req.params.id; }); | ||||||
| if (!category) { | ||||||
| res.status(404).json({ message: 'not found' }); | ||||||
| return; | ||||||
| } | ||||||
| res.json(category); | ||||||
| }); | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [HIGH] security: Missing authentication on POST endpoint All API endpoints that modify data must require authentication, as per There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [HIGH] quality: Missing error handling in POST /categories route The route handler for |
||||||
|
|
||||||
| // create category | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [HIGH] security: Missing input validation and sanitization for category creation User input for |
||||||
| router.post('/', function(req, res) { | ||||||
| var category = { | ||||||
| id: nextId++, | ||||||
| name: req.body.name, | ||||||
| description: req.body.description, | ||||||
| color: req.body.color | ||||||
| }; | ||||||
| categories.push(category); | ||||||
| res.json(category); | ||||||
| }); | ||||||
|
|
||||||
| // update category | ||||||
| router.patch('/:id', function(req, res) { | ||||||
| var category = categories.find(function(c) { return c.id == req.params.id; }); | ||||||
| if (!category) { | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [HIGH] security: Missing authentication on PATCH endpoint All API endpoints that modify data must require authentication, as per There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [HIGH] quality: Missing error handling in PATCH /categories/:id route The route handler for |
||||||
| res.status(404).json({ message: 'not found' }); | ||||||
| return; | ||||||
| } | ||||||
| if (req.body.name) category.name = req.body.name; | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [HIGH] security: Missing input validation and sanitization for category update User input for |
||||||
| if (req.body.description) category.description = req.body.description; | ||||||
| if (req.body.color) category.color = req.body.color; | ||||||
| res.json(category); | ||||||
| }); | ||||||
|
|
||||||
| // delete category | ||||||
| router.delete('/:id', function(req, res) { | ||||||
| var index = categories.findIndex(function(c) { return c.id == req.params.id; }); | ||||||
| if (index === -1) { | ||||||
| res.status(404).json({ message: 'not found' }); | ||||||
| return; | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [HIGH] security: Missing authentication on DELETE endpoint All API endpoints that modify data must require authentication, as per There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 [HIGH] quality: Missing error handling in DELETE /categories/:id route The route handler for |
||||||
| } | ||||||
| categories.splice(index, 1); | ||||||
| res.json({ message: 'deleted' }); | ||||||
| }); | ||||||
|
|
||||||
| module.exports = router; | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 [MEDIUM] style: Use
constorletinstead ofvarThe use of
varis discouraged byreview-rules.md. Please useconstfor variables that are not reassigned andletfor those that are. This applies to multiple declarations in this file.Suggestion: