fix: remediate 4 SAST findings in app.js (asset 73206)

[eduardoconviso]

Summary

Remediates the 4 latest vulnerabilities reported by Conviso AST for asset 73206 (teste2), all in app.js.

Issue	Type	Severity	Endpoint	Line
7823033	OS Command Injection	HIGH	/ping	44
7823032	SQL Injection	HIGH	/users	35
7823031	Reflected XSS	MEDIUM	/greet	19
7823030	DOM XSS	MEDIUM	/search	25

Fixes

• OS Command Injection (/ping) — replaced exec('ping -c 1 ' + host) with execFile('ping', ['-c','1','--', host]) so no shell is spawned; host is validated against a hostname/IP allowlist (/^[a-zA-Z0-9.-]{1,253}$/, leading - rejected) before use.
• SQL Injection (/users) — id is now bound as a parameter (SELECT * FROM users WHERE id = ?, [id]) instead of string concatenation. The db.query stub was updated to a (sql, params, cb) signature mirroring real drivers.
• Reflected XSS (/greet) — user input is HTML-escaped via a new escapeHtml() helper before being written to the response.
• DOM XSS (/search) — the value is JSON-encoded into a JS string literal (with < escaped to prevent early </script>) and assigned via textContent instead of innerHTML.

Testing

• node --check app.js passes.

Note: pre-existing path-traversal (/download) and SSRF (/fetch) sinks were out of scope for these 4 issues and left untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LMYDs3LsR9Ck2VBqtntfrn

[conviso-platform-appsec-staging]

🛡️ Conviso Application Security Scan Results

Summary: 0 Critical | 0 High | 3 Medium | 1 Low

---

🟠 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity: Medium | File: app.js:33

User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within.

res.send('<h1>Hello, ' + escapeHtml(name) + '!</h1>');

---

🟠 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity: Medium | File: app.js:43

Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.

res.send(`
    <script>
      document.getElementById('results').textContent = "Results for: " + ${encoded};
    </script>
  `);

---

🔵 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity: Low | File: app.js:45

Cannot determine what 'encoded' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'encoded' is not externally controlled, or sanitize this data.

document.getElementById('results').textContent = "Results for: " + ${encoded};

---