baselineResults.json

{
  "_links": {
    "root": {
      "href": "/"
    },
    "self": {
      "href": "/scans/c568926a-aec9-4807-91dc-2a8f244932cd/findings"
    },
    "help": {
      "href": "https://help.veracode.com/reader/tS9CaFwL4_lbIEWWomsJoA/ovfZGgu96UINQxIuTqRDwg"
    }
  },
  "scan_id": "c568926a-aec9-4807-91dc-2a8f244932cd",
  "scan_status": "SUCCESS",
  "message": "Scan successful. Results size: 37976 bytes",
  "modules": [
    "JS files within NodeGoat-JS-main.zip"
  ],
  "modules_count": 1,
  "findings": [
    {
      "title": "eval",
      "issue_id": 1014,
      "gob": "B",
      "severity": 5,
      "issue_type_id": "taint",
      "issue_type": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
      "cwe_id": "95",
      "display_text": "\u003cspan\u003eThis call to eval() contains untrusted input or potentially untrusted data.  If this input could be modified by an attacker, arbitrary JS code could be executed. \u003c/span\u003e \u003cspan\u003eValidate all untrusted and untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.  In general, avoid executing code derived from untrusted input.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/95.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/routes/contributions.js",
          "line": 32,
          "function_name": "lambda_5",
          "qualified_function_name": "lambda_5",
          "function_prototype": "lambda_5(: any,  : express::Request,  : express::Response,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "4175066609",
        "prototype_hash": "229243849",
        "flaw_hash": "3341717358",
        "flaw_hash_count": 3,
        "flaw_hash_ordinal": 1,
        "cause_hash": "3693385549",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "4013394447",
        "cause_hash2_ordinal": "1"
      },
      "stack_dumps": {
        "stack_dump": [
          {}
        ]
      },
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/95.html"
    },
    {
      "title": "eval",
      "issue_id": 1012,
      "gob": "B",
      "severity": 5,
      "issue_type_id": "taint",
      "issue_type": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
      "cwe_id": "95",
      "display_text": "\u003cspan\u003eThis call to eval() contains untrusted input or potentially untrusted data.  If this input could be modified by an attacker, arbitrary JS code could be executed. \u003c/span\u003e \u003cspan\u003eValidate all untrusted and untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.  In general, avoid executing code derived from untrusted input.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/95.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/routes/contributions.js",
          "line": 33,
          "function_name": "lambda_5",
          "qualified_function_name": "lambda_5",
          "function_prototype": "lambda_5(: any,  : express::Request,  : express::Response,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "4175066609",
        "prototype_hash": "229243849",
        "flaw_hash": "3341717358",
        "flaw_hash_count": 3,
        "flaw_hash_ordinal": 2,
        "cause_hash": "3693385549",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "4013394447",
        "cause_hash2_ordinal": "1"
      },
      "stack_dumps": {
        "stack_dump": [
          {}
        ]
      },
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/95.html"
    },
    {
      "title": "mongodb.Collection.insert",
      "issue_id": 1018,
      "gob": "B",
      "severity": 4,
      "issue_type_id": "taint",
      "issue_type": "Improper Neutralization of Special Elements in Data Query Logic",
      "cwe_id": "943",
      "display_text": "\u003cspan\u003eThis NoSQL API call contains an injection flaw.  In the call or reference to mongodb.Collection.insert, the application executes an operation designed to manipulate data in the database, but part of that query is constructed from untrusted data.  An attacker could exploit this flaw to modify arbitrary data inside the database or replace a query value to bypass authentication or access unauthorized data.  \u003c/span\u003e \u003cspan\u003eAvoid passing user-generated data to queries outside of data fields.  Ensure that query values are validated to authorize the requesting user before accessing the data.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/943.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/routes/memos.js",
          "line": 13,
          "function_name": "lambda_2",
          "qualified_function_name": "lambda_2",
          "function_prototype": "lambda_2(: any,  : express::Request,  : express::Response,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "2919528008",
        "prototype_hash": "2577801440",
        "flaw_hash": "741367337",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "1131682964",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "4013394447",
        "cause_hash2_ordinal": "1"
      },
      "stack_dumps": {
        "stack_dump": [
          {}
        ]
      },
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/943.html"
    },
    {
      "title": "update",
      "issue_id": 1020,
      "gob": "B",
      "severity": 4,
      "issue_type_id": "crypto",
      "issue_type": "Authorization Bypass Through User-Controlled Key",
      "cwe_id": "639",
      "display_text": "\u003cspan\u003eThe property named update contains untrusted data, and (due to its name) may contain internal authorization data. \u003c/span\u003e \u003cspan\u003eEnsure that nothing in this application relies on this value to be a trusted indicator of security privilege or identity.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/639.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/data/contributions-dao.js",
          "line": 28,
          "function_name": "lambda_3",
          "qualified_function_name": "lambda_3",
          "function_prototype": "lambda_3(: any,  : any,  : any,  : any,  : any,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "2408749517",
        "prototype_hash": "2953293440",
        "flaw_hash": "1337759664",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "2898746875",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/639.html"
    },
    {
      "title": "findOne",
      "issue_id": 1017,
      "gob": "B",
      "severity": 4,
      "issue_type_id": "crypto",
      "issue_type": "Authorization Bypass Through User-Controlled Key",
      "cwe_id": "639",
      "display_text": "\u003cspan\u003eThe property named findOne contains untrusted data, and (due to its name) may contain internal authorization data. \u003c/span\u003e \u003cspan\u003eEnsure that nothing in this application relies on this value to be a trusted indicator of security privilege or identity.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/639.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/data/contributions-dao.js",
          "line": 57,
          "function_name": "lambda_6",
          "qualified_function_name": "lambda_6",
          "function_prototype": "lambda_6(: any,  : any,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "2443115013",
        "prototype_hash": "2572409583",
        "flaw_hash": "3218150524",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "3903414968",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/639.html"
    },
    {
      "title": "update",
      "issue_id": 1019,
      "gob": "B",
      "severity": 4,
      "issue_type_id": "crypto",
      "issue_type": "Authorization Bypass Through User-Controlled Key",
      "cwe_id": "639",
      "display_text": "\u003cspan\u003eThe property named update contains untrusted data, and (due to its name) may contain internal authorization data. \u003c/span\u003e \u003cspan\u003eEnsure that nothing in this application relies on this value to be a trusted indicator of security privilege or identity.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/639.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/data/allocations-dao.js",
          "line": 29,
          "function_name": "lambda_4",
          "qualified_function_name": "lambda_4",
          "function_prototype": "lambda_4(: any,  : any,  : any,  : any,  : any,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1347358713",
        "prototype_hash": "661512314",
        "flaw_hash": "1337759664",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "2898746875",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/639.html"
    },
    {
      "title": "set",
      "issue_id": 1008,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Use of Hard-coded Credentials",
      "cwe_id": "798",
      "display_text": "\u003cspan\u003eThe application contains hard-coded information that may contain credentials to an external service.  The use of hard-coded credentials significantly increases the possibility that the account being protected will be compromised. set\u003c/span\u003e \u003cspan\u003eStore credentials out-of-band from the application code.  Follow best practices for protecting credentials stored in locations such as configuration or properties files.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/798.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/test/security/profile-test.js",
          "line": 36,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1170154743",
        "prototype_hash": "211846691",
        "flaw_hash": "858018154",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "4288950972",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/798.html"
    },
    {
      "title": "set",
      "issue_id": 1009,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Use of Hard-coded Password",
      "cwe_id": "259",
      "display_text": "\u003cspan\u003eThis variable assignment uses a hard-coded password that may compromise system security in a way that cannot be easily remedied.  The use of a hard-coded password significantly increases the possibility that the account being protected will be compromised.  Moreover, the password cannot be changed without patching the software.  If a hard-coded password is compromised in a commercial product, all deployed instances may be vulnerable to attack.  In some cases, this finding may indicate a reference to a password (e.g. the name of a key in a properties file) rather than an actual password. set\u003c/span\u003e \u003cspan\u003eStore passwords out-of-band from the application code.  Follow best practices for protecting credentials stored in locations such as configuration or properties files. An HSM may be appropriate for particularly sensitive credentials.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/259.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/test/security/profile-test.js",
          "line": 37,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1170154743",
        "prototype_hash": "211846691",
        "flaw_hash": "2943848756",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "35058981",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/259.html"
    },
    {
      "title": "console.log",
      "issue_id": 1010,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "taint",
      "issue_type": "Cleartext Storage of Sensitive Information",
      "cwe_id": "312",
      "display_text": "\u003cspan\u003eThe console.log() method stores sensitive information in unencrypted form, making the data more susceptible to compromise. Generally an attacker needs local access to the system in order to exploit this type of flaw, but with mobile devices, files and other resources are often synchronized off the device to locations where they may be compromised through other means.\u003c/span\u003e \u003cspan\u003eStore all sensitive information in encrypted form.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/312.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/test/security/profile-test.js",
          "line": 270,
          "function_name": "lambda_21",
          "qualified_function_name": "lambda_21",
          "function_prototype": "lambda_21(: any,  : any,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "2637030245",
        "prototype_hash": "2531540556",
        "flaw_hash": "3367394315",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "1971195192",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "3098907856",
        "cause_hash2_ordinal": "1"
      },
      "stack_dumps": {
        "stack_dump": [
          {}
        ]
      },
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/312.html"
    },
    {
      "title": "swig.setDefaults",
      "issue_id": 1024,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Improper Neutralization of Invalid Characters in Identifiers in Web Pages",
      "cwe_id": "86",
      "display_text": "\u003cspan\u003eWhen the \u0027autoescape\u0027 property is set to false in a call to swig.setDefaults(), a significant line of defense against cross-site scripting attacks is disabled.\u003c/span\u003e \u003cspan\u003eWhere unfiltered output is required, use individual instances of the safe filter and regularly review their use to ensure mitigation against XSS attacks is in place.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/86.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/server.js",
          "line": 133,
          "function_name": "lambda_2",
          "qualified_function_name": "lambda_2",
          "function_prototype": "lambda_2(: any,  : any,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "2277052749",
        "prototype_hash": "685750975",
        "flaw_hash": "3132762339",
        "flaw_hash_count": 2,
        "flaw_hash_ordinal": 2,
        "cause_hash": "1176028798",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/86.html"
    },
    {
      "title": "set",
      "issue_id": 1001,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Use of Hard-coded Credentials",
      "cwe_id": "798",
      "display_text": "\u003cspan\u003eThe application contains hard-coded information that may contain credentials to an external service.  The use of hard-coded credentials significantly increases the possibility that the account being protected will be compromised. set\u003c/span\u003e \u003cspan\u003eStore credentials out-of-band from the application code.  Follow best practices for protecting credentials stored in locations such as configuration or properties files.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/798.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/config/env/test.js",
          "line": 6,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "2493660156",
        "prototype_hash": "211846691",
        "flaw_hash": "1321220973",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "3504791042",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/798.html"
    },
    {
      "title": "set",
      "issue_id": 1002,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Use of Hard-coded Credentials",
      "cwe_id": "798",
      "display_text": "\u003cspan\u003eThe application contains hard-coded information that may contain credentials to an external service.  The use of hard-coded credentials significantly increases the possibility that the account being protected will be compromised. set\u003c/span\u003e \u003cspan\u003eStore credentials out-of-band from the application code.  Follow best practices for protecting credentials stored in locations such as configuration or properties files.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/798.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/config/env/development.js",
          "line": 6,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "2515264190",
        "prototype_hash": "211846691",
        "flaw_hash": "1321220973",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "3504791042",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/798.html"
    },
    {
      "title": "set",
      "issue_id": 1000,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Use of Hard-coded Credentials",
      "cwe_id": "798",
      "display_text": "\u003cspan\u003eThe application contains hard-coded information that may contain credentials to an external service.  The use of hard-coded credentials significantly increases the possibility that the account being protected will be compromised. set\u003c/span\u003e \u003cspan\u003eStore credentials out-of-band from the application code.  Follow best practices for protecting credentials stored in locations such as configuration or properties files.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/798.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/artifacts/db-reset.js",
          "line": 15,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1397445541",
        "prototype_hash": "211846691",
        "flaw_hash": "116960928",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "474192736",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/798.html"
    },
    {
      "title": "set",
      "issue_id": 1005,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Use of Hard-coded Password",
      "cwe_id": "259",
      "display_text": "\u003cspan\u003eThis variable assignment uses a hard-coded password that may compromise system security in a way that cannot be easily remedied.  The use of a hard-coded password significantly increases the possibility that the account being protected will be compromised.  Moreover, the password cannot be changed without patching the software.  If a hard-coded password is compromised in a commercial product, all deployed instances may be vulnerable to attack.  In some cases, this finding may indicate a reference to a password (e.g. the name of a key in a properties file) rather than an actual password. set\u003c/span\u003e \u003cspan\u003eStore passwords out-of-band from the application code.  Follow best practices for protecting credentials stored in locations such as configuration or properties files. An HSM may be appropriate for particularly sensitive credentials.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/259.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/artifacts/db-reset.js",
          "line": 18,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1397445541",
        "prototype_hash": "211846691",
        "flaw_hash": "1700687745",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "3596938865",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/259.html"
    },
    {
      "title": "set",
      "issue_id": 1006,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Use of Hard-coded Credentials",
      "cwe_id": "798",
      "display_text": "\u003cspan\u003eThe application contains hard-coded information that may contain credentials to an external service.  The use of hard-coded credentials significantly increases the possibility that the account being protected will be compromised. set\u003c/span\u003e \u003cspan\u003eStore credentials out-of-band from the application code.  Follow best practices for protecting credentials stored in locations such as configuration or properties files.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/798.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/artifacts/db-reset.js",
          "line": 23,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1397445541",
        "prototype_hash": "211846691",
        "flaw_hash": "3045723571",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "3861303959",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/798.html"
    },
    {
      "title": "set",
      "issue_id": 1007,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Use of Hard-coded Password",
      "cwe_id": "259",
      "display_text": "\u003cspan\u003eThis variable assignment uses a hard-coded password that may compromise system security in a way that cannot be easily remedied.  The use of a hard-coded password significantly increases the possibility that the account being protected will be compromised.  Moreover, the password cannot be changed without patching the software.  If a hard-coded password is compromised in a commercial product, all deployed instances may be vulnerable to attack.  In some cases, this finding may indicate a reference to a password (e.g. the name of a key in a properties file) rather than an actual password. set\u003c/span\u003e \u003cspan\u003eStore passwords out-of-band from the application code.  Follow best practices for protecting credentials stored in locations such as configuration or properties files. An HSM may be appropriate for particularly sensitive credentials.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/259.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/artifacts/db-reset.js",
          "line": 27,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1397445541",
        "prototype_hash": "211846691",
        "flaw_hash": "2154831999",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "3902379264",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/259.html"
    },
    {
      "title": "set",
      "issue_id": 1004,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Use of Hard-coded Credentials",
      "cwe_id": "798",
      "display_text": "\u003cspan\u003eThe application contains hard-coded information that may contain credentials to an external service.  The use of hard-coded credentials significantly increases the possibility that the account being protected will be compromised. set\u003c/span\u003e \u003cspan\u003eStore credentials out-of-band from the application code.  Follow best practices for protecting credentials stored in locations such as configuration or properties files.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/798.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/artifacts/db-reset.js",
          "line": 31,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1397445541",
        "prototype_hash": "211846691",
        "flaw_hash": "1017465666",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "3334747344",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/798.html"
    },
    {
      "title": "set",
      "issue_id": 1003,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Use of Hard-coded Password",
      "cwe_id": "259",
      "display_text": "\u003cspan\u003eThis variable assignment uses a hard-coded password that may compromise system security in a way that cannot be easily remedied.  The use of a hard-coded password significantly increases the possibility that the account being protected will be compromised.  Moreover, the password cannot be changed without patching the software.  If a hard-coded password is compromised in a commercial product, all deployed instances may be vulnerable to attack.  In some cases, this finding may indicate a reference to a password (e.g. the name of a key in a properties file) rather than an actual password. set\u003c/span\u003e \u003cspan\u003eStore passwords out-of-band from the application code.  Follow best practices for protecting credentials stored in locations such as configuration or properties files. An HSM may be appropriate for particularly sensitive credentials.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/259.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/artifacts/db-reset.js",
          "line": 35,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1397445541",
        "prototype_hash": "211846691",
        "flaw_hash": "3515079443",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "2956038410",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/259.html"
    },
    {
      "title": "__vc_output_raw",
      "issue_id": 1022,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "taint",
      "issue_type": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
      "cwe_id": "80",
      "display_text": "\u003cspan\u003eThis call to __vc_output_raw() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim\u0027s browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. \u003c/span\u003e \u003cspan\u003eUse contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/79.html\"\u003eCWE\u003c/a\u003e \u003ca href\u003d\"https://owasp.org/www-community/attacks/xss/\"\u003eOWASP\u003c/a\u003e \u003ca href\u003d\"https://docs.veracode.com/r/review_cleansers\"\u003eSupported Cleansers\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/views/benefits.html",
          "line": 50,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1947986425",
        "prototype_hash": "211846691",
        "flaw_hash": "1768845473",
        "flaw_hash_count": 2,
        "flaw_hash_ordinal": 1,
        "cause_hash": "484578331",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "3333277282",
        "cause_hash2_ordinal": "1"
      },
      "stack_dumps": {
        "stack_dump": [
          {}
        ]
      },
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/80.html"
    },
    {
      "title": "__vc_output_raw",
      "issue_id": 1023,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "taint",
      "issue_type": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
      "cwe_id": "80",
      "display_text": "\u003cspan\u003eThis call to __vc_output_raw() contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim\u0027s browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. \u003c/span\u003e \u003cspan\u003eUse contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/79.html\"\u003eCWE\u003c/a\u003e \u003ca href\u003d\"https://owasp.org/www-community/attacks/xss/\"\u003eOWASP\u003c/a\u003e \u003ca href\u003d\"https://docs.veracode.com/r/review_cleansers\"\u003eSupported Cleansers\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/views/benefits.html",
          "line": 56,
          "function_name": "!main",
          "qualified_function_name": "!main",
          "function_prototype": "!main() : void",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "1947986425",
        "prototype_hash": "211846691",
        "flaw_hash": "1768845473",
        "flaw_hash_count": 2,
        "flaw_hash_ordinal": 2,
        "cause_hash": "484578331",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "3333277282",
        "cause_hash2_ordinal": "1"
      },
      "stack_dumps": {
        "stack_dump": [
          {}
        ]
      },
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/80.html"
    },
    {
      "title": "console.log",
      "issue_id": 1011,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "taint",
      "issue_type": "Improper Output Neutralization for Logs",
      "cwe_id": "117",
      "display_text": "\u003cspan\u003eThis call to console.log() could result in a log forging attack.  Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files.  Corrupted log files can be used to cover an attacker\u0027s tracks or as a delivery mechanism for an attack on a log viewing or processing utility.  For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. \u003c/span\u003e \u003cspan\u003eAvoid directly embedding user input in log files when possible.  Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data.  Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences.  Only create a custom blocklist when absolutely necessary.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/117.html\"\u003eCWE\u003c/a\u003e \u003ca href\u003d\"https://owasp.org/www-community/attacks/Log_Injection\"\u003eOWASP\u003c/a\u003e \u003ca href\u003d\"https://docs.veracode.com/r/review_cleansers?tocId\u003dnYnZqAenFFZmB75MQrZwuA\"\u003eSupported Cleansers\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/routes/session.js",
          "line": 62,
          "function_name": "lambda_7",
          "qualified_function_name": "lambda_7",
          "function_prototype": "lambda_7(: any,  : any,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "4046061501",
        "prototype_hash": "1317673167",
        "flaw_hash": "2066068431",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "3493248439",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "1522093433",
        "cause_hash2_ordinal": "4"
      },
      "stack_dumps": {
        "stack_dump": [
          {}
        ]
      },
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/117.html"
    },
    {
      "title": "express.Response.redirect",
      "issue_id": 1015,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "taint",
      "issue_type": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
      "cwe_id": "601",
      "display_text": "\u003cspan\u003eThis call to express.Response.redirect() contains a URL redirection to untrusted site flaw.  Writing untrusted input into a URL value could cause the web application to redirect the request to the specified URL, leading to phishing attempts to steal user credentials.\u003c/span\u003e \u003cspan\u003eAlways validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. \u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/601.html\"\u003eCWE\u003c/a\u003e \u003ca href\u003d\"https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html\"\u003eOWASP\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/routes/index.js",
          "line": 74,
          "function_name": "lambda_1",
          "qualified_function_name": "lambda_1",
          "function_prototype": "lambda_1(: any,  : express::Request,  : express::Response, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "3376556419",
        "prototype_hash": "2658631907",
        "flaw_hash": "3132379930",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "4284885398",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "4013394447",
        "cause_hash2_ordinal": "1"
      },
      "stack_dumps": {
        "stack_dump": [
          {}
        ]
      },
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/601.html"
    },
    {
      "title": "update",
      "issue_id": 1021,
      "gob": "B",
      "severity": 3,
      "issue_type_id": "crypto",
      "issue_type": "Cleartext Storage of Sensitive Information",
      "cwe_id": "312",
      "display_text": "\u003cspan\u003eThe update() method stores sensitive information in unencrypted form, making the data more susceptible to compromise. Generally an attacker needs local access to the system in order to exploit this type of flaw, but if the application is running on a mobile device, files and other resources might be synchronized off the device to locations where they may be compromised through other means.\u003c/span\u003e \u003cspan\u003eStore all sensitive information in encrypted form.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/312.html\"\u003eCWE\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/app/data/profile-dao.js",
          "line": 78,
          "function_name": "lambda_2",
          "qualified_function_name": "lambda_2",
          "function_prototype": "lambda_2(: any,  : any,  : any,  : any,  : any,  : any,  : any,  : any,  : any,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "33876044",
        "prototype_hash": "3897417335",
        "flaw_hash": "3713759949",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "3376977546",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/312.html"
    },
    {
      "title": "!func",
      "issue_id": 1016,
      "gob": "B",
      "severity": 2,
      "issue_type_id": "crypto",
      "issue_type": "Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute",
      "cwe_id": "614",
      "display_text": "\u003cspan\u003eThis call to !func() adds a cookie to the HTTP response that does not have the Secure attribute set.  Failing to set this attribute allows the browser to send the cookie unencrypted over an HTTP session. \u003c/span\u003e \u003cspan\u003eSet the Secure attribute for all cookies used by HTTPS sessions.\u003c/span\u003e \u003cspan\u003eReferences: \u003ca href\u003d\"https://cwe.mitre.org/data/definitions/614.html\"\u003eCWE\u003c/a\u003e \u003ca href\u003d\"https://owasp.org/www-community/controls/SecureCookieAttribute\"\u003eOWASP\u003c/a\u003e\u003c/span\u003e",
      "files": {
        "source_file": {
          "file": "NodeGoat-JS-main/server.js",
          "line": 78,
          "function_name": "lambda_2",
          "qualified_function_name": "lambda_2",
          "function_prototype": "lambda_2(: any,  : any,  : any, ...) : any",
          "scope": "UNKNOWN"
        }
      },
      "flaw_match": {
        "procedure_hash": "2277052749",
        "prototype_hash": "685750975",
        "flaw_hash": "1659954946",
        "flaw_hash_count": 1,
        "flaw_hash_ordinal": 1,
        "cause_hash": "1655898003",
        "cause_hash_count": 1,
        "cause_hash_ordinal": 1,
        "cause_hash2": "0",
        "cause_hash2_ordinal": "0"
      },
      "stack_dumps": {},
      "flaw_details_link": "https://downloads.veracode.com/securityscan/cwe/v4/java/614.html"
    }
  ],
  "selected_modules": [],
  "pipeline_scan": "23.9.0-0",
  "dev_stage": "DEVELOPMENT"
}