{
  "version": "1.171.0",
  "results": [
    {
      "check_id": "dockerfile.security.missing-user.missing-user",
      "path": "Dockerfile",
      "start": {
        "line": 7,
        "col": 1,
        "offset": 164
      },
      "end": {
        "line": 7,
        "col": 23,
        "offset": 186
      },
      "extra": {
        "message": "By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.",
        "fix": "USER non-root\nCMD [\"node\", \"app.js\"]",
        "metadata": {
          "cwe": [
            "CWE-250: Execution with Unnecessary Privileges"
          ],
          "category": "security",
          "technology": [
            "dockerfile"
          ],
          "confidence": "MEDIUM",
          "owasp": [
            "A04:2021 - Insecure Design",
            "A06:2025 - Insecure Design"
          ],
          "references": [
            "https://owasp.org/Top10/A04_2021-Insecure_Design"
          ],
          "subcategory": [
            "audit"
          ],
          "likelihood": "LOW",
          "impact": "MEDIUM",
          "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
          "vulnerability_class": [
            "Improper Authorization"
          ],
          "source": "https://semgrep.dev/r/dockerfile.security.missing-user.missing-user",
          "shortlink": "https://sg.run/Gbvn"
        },
        "severity": "ERROR",
        "fingerprint": "requires login",
        "lines": "requires login",
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "OSS"
      }
    },
    {
      "check_id": "javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage",
      "path": "app.js",
      "start": {
        "line": 10,
        "col": 5,
        "offset": 262
      },
      "end": {
        "line": 10,
        "col": 20,
        "offset": 277
      },
      "extra": {
        "message": "A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies.",
        "metadata": {
          "category": "security",
          "references": [
            "https://www.npmjs.com/package/csurf",
            "https://www.npmjs.com/package/csrf",
            "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"
          ],
          "cwe": [
            "CWE-352: Cross-Site Request Forgery (CSRF)"
          ],
          "owasp": [
            "A01:2021 - Broken Access Control",
            "A01:2025 - Broken Access Control"
          ],
          "technology": [
            "javascript",
            "typescript",
            "express"
          ],
          "cwe2022-top25": true,
          "cwe2021-top25": true,
          "subcategory": [
            "audit"
          ],
          "likelihood": "LOW",
          "impact": "HIGH",
          "confidence": "LOW",
          "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
          "vulnerability_class": [
            "Cross-Site Request Forgery (CSRF)"
          ],
          "source": "https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage",
          "shortlink": "https://sg.run/BxzR"
        },
        "severity": "INFO",
        "fingerprint": "requires login",
        "lines": "requires login",
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "OSS"
      }
    },
    {
      "check_id": "javascript.express.security.audit.xss.direct-response-write.direct-response-write",
      "path": "app.js",
      "start": {
        "line": 43,
        "col": 12,
        "offset": 1104
      },
      "end": {
        "line": 43,
        "col": 13,
        "offset": 1105
      },
      "extra": {
        "message": "Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.",
        "metadata": {
          "interfile": true,
          "references": [
            "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
          ],
          "owasp": [
            "A07:2017 - Cross-Site Scripting (XSS)",
            "A03:2021 - Injection",
            "A05:2025 - Injection"
          ],
          "cwe": [
            "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
          ],
          "category": "security",
          "technology": [
            "express"
          ],
          "cwe2022-top25": true,
          "cwe2021-top25": true,
          "subcategory": [
            "vuln"
          ],
          "likelihood": "MEDIUM",
          "impact": "MEDIUM",
          "confidence": "MEDIUM",
          "vulnerability_class": [
            "Cross-Site-Scripting (XSS)"
          ],
          "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
          "source": "https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write",
          "shortlink": "https://sg.run/vzGl"
        },
        "severity": "WARNING",
        "fingerprint": "requires login",
        "lines": "requires login",
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "OSS"
      }
    },
    {
      "check_id": "problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server",
      "path": "app.js",
      "start": {
        "line": 53,
        "col": 1,
        "offset": 1299
      },
      "end": {
        "line": 53,
        "col": 5,
        "offset": 1303
      },
      "extra": {
        "message": "Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information.",
        "metadata": {
          "likelihood": "LOW",
          "impact": "MEDIUM",
          "confidence": "LOW",
          "category": "security",
          "cwe": "CWE-319: Cleartext Transmission of Sensitive Information",
          "owasp": [
            "A02:2021 - Cryptographic Failures",
            "A03:2017 - Sensitive Data Exposure",
            "A04:2025 - Cryptographic Failures"
          ],
          "references": [
            "https://nodejs.org/api/http.html#http_class_http_agent",
            "https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY"
          ],
          "subcategory": [
            "audit"
          ],
          "technology": [
            "node.js"
          ],
          "vulnerability": "Insecure Transport",
          "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
          "vulnerability_class": [
            "Mishandled Sensitive Information"
          ],
          "source": "https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server",
          "shortlink": "https://sg.run/x1zL"
        },
        "severity": "WARNING",
        "fingerprint": "requires login",
        "lines": "requires login",
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "OSS"
      }
    },
    {
      "check_id": "javascript.express.security.audit.remote-property-injection.remote-property-injection",
      "path": "routes/_search.js",
      "start": {
        "line": 110,
        "col": 4,
        "offset": 2569
      },
      "end": {
        "line": 110,
        "col": 53,
        "offset": 2618
      },
      "extra": {
        "message": "Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties.",
        "metadata": {
          "confidence": "LOW",
          "owasp": [
            "A02:2017 - Broken Authentication",
            "A04:2021 - Insecure Design",
            "A06:2025 - Insecure Design"
          ],
          "cwe": [
            "CWE-522: Insufficiently Protected Credentials"
          ],
          "category": "security",
          "technology": [
            "express"
          ],
          "references": [
            "https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md"
          ],
          "cwe2021-top25": true,
          "subcategory": [
            "vuln"
          ],
          "likelihood": "MEDIUM",
          "impact": "MEDIUM",
          "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
          "vulnerability_class": [
            "Cryptographic Issues"
          ],
          "source": "https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection",
          "shortlink": "https://sg.run/Z4gn"
        },
        "severity": "ERROR",
        "fingerprint": "requires login",
        "lines": "requires login",
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "OSS"
      }
    },
    {
      "check_id": "javascript.express.security.audit.xss.direct-response-write.direct-response-write",
      "path": "routes/_search.js",
      "start": {
        "line": 114,
        "col": 14,
        "offset": 2695
      },
      "end": {
        "line": 114,
        "col": 17,
        "offset": 2698
      },
      "extra": {
        "message": "Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.",
        "metadata": {
          "interfile": true,
          "references": [
            "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
          ],
          "owasp": [
            "A07:2017 - Cross-Site Scripting (XSS)",
            "A03:2021 - Injection",
            "A05:2025 - Injection"
          ],
          "cwe": [
            "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
          ],
          "category": "security",
          "technology": [
            "express"
          ],
          "cwe2022-top25": true,
          "cwe2021-top25": true,
          "subcategory": [
            "vuln"
          ],
          "likelihood": "MEDIUM",
          "impact": "MEDIUM",
          "confidence": "MEDIUM",
          "vulnerability_class": [
            "Cross-Site-Scripting (XSS)"
          ],
          "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
          "source": "https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write",
          "shortlink": "https://sg.run/vzGl"
        },
        "severity": "WARNING",
        "fingerprint": "requires login",
        "lines": "requires login",
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "OSS"
      }
    }
  ],
  "errors": [],
  "paths": {
    "scanned": [
      ".gitignore",
      "Dockerfile",
      "README.md",
      "app.js",
      "config.js",
      "config.js-sample",
      "downloads/.gitkeep",
      "logger/http_push.js",
      "logger/index.js",
      "logger/sqlite.js",
      "logs/.gitkeep",
      "package.json",
      "routes/404.js",
      "routes/_search.js",
      "routes/index.js",
      "views/es-response/0.90.0.js",
      "views/es-response/0.90.5.js",
      "views/es-response/1.1.1.js",
      "views/es-response/1.2.1.js",
      "views/es-response/1.2.2.js",
      "views/es-response/1.3.1.js",
      "views/es-response/default.js"
    ]
  },
  "time": {
    "rules": [],
    "rules_parse_time": 2.1369900703430176,
    "profiling_times": {
      "config_time": 3.6603236198425293,
      "core_time": 4.310145854949951,
      "ignores_time": 0.002034425735473633,
      "total_time": 7.987117290496826
    },
    "parsing_time": {
      "total_time": 0.0,
      "per_file_time": {
        "mean": 0.0,
        "std_dev": 0.0
      },
      "very_slow_stats": {
        "time_ratio": 0.0,
        "count_ratio": 0.0
      },
      "very_slow_files": []
    },
    "scanning_time": {
      "total_time": 0.8680071830749512,
      "per_file_time": {
        "mean": 0.01422962595204838,
        "std_dev": 0.0016590769176791954
      },
      "very_slow_stats": {
        "time_ratio": 0.0,
        "count_ratio": 0.0
      },
      "very_slow_files": []
    },
    "matching_time": {
      "total_time": 0.0,
      "per_file_and_rule_time": {
        "mean": 0.0,
        "std_dev": 0.0
      },
      "very_slow_stats": {
        "time_ratio": 0.0,
        "count_ratio": 0.0
      },
      "very_slow_rules_on_files": []
    },
    "tainting_time": {
      "total_time": 0.0,
      "per_def_and_rule_time": {
        "mean": 0.0,
        "std_dev": 0.0
      },
      "very_slow_stats": {
        "time_ratio": 0.0,
        "count_ratio": 0.0
      },
      "very_slow_rules_on_defs": []
    },
    "fixpoint_timeouts": [],
    "prefiltering": {
      "project_level_time": 0.0,
      "file_level_time": 0.0,
      "rules_with_project_prefilters_ratio": 0.0,
      "rules_with_file_prefilters_ratio": 0.9901079136690647,
      "rules_selected_ratio": 0.021282973621103117,
      "rules_matched_ratio": 0.021282973621103117
    },
    "targets": [],
    "total_bytes": 0,
    "max_memory_bytes": 920157952
  },
  "engine_requested": "OSS",
  "skipped_rules": [],
  "profiling_results": []
}