Feature/workspaces api services by philvarner-snyk · Pull Request #31 · varner-tech/nodejs-goof

philvarner-snyk · 2026-02-27T15:28:19Z

No description provided.

… DevOps

…shboard

Introduce multi-workspace support with role-based access control, audit logging, webhook delivery, rule engine with scheduled execution, CSV todo import, and notes CRUD. Adds new Mongoose models (Workspace, WorkspaceMember, AuditEvent, Webhook, WebhookDelivery, Rule, Note), API middleware, and supporting documentation. Made-with: Cursor

philvarner-snyk · 2026-02-27T15:28:29Z

⛔ Snyk checks have failed. 12 issues have been found so far.

Status	Scan Engine	High	Total (12)
⛔	Open Source Security	3	3 issues
✅	Licenses	0	0 issues
⛔	Code Security	9	9 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

philvarner-snyk · 2026-02-27T15:28:39Z

routes/audit.js

+      if (req.query.from) q.createdAt.$gte = new Date(req.query.from);
+      if (req.query.to) q.createdAt.$lte = new Date(req.query.to);
+    }
+    AuditEvent.countDocuments(q).exec(function (err, total) {


NoSQL Injection

Unsanitized input from an HTTP parameter flows into countDocuments, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 70 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Data flow: 11 steps

Step 1 - 9

nodejs-goof/routes/audit.js

Line 62 in 8eab186

if (typeof req.query.action === 'string' && req.query.action.trim()) q.action = req.query.action.trim();

Step 10 - 11

nodejs-goof/routes/audit.js

Line 70 in 8eab186

AuditEvent.countDocuments(q).exec(function (err, total) {

philvarner-snyk · 2026-02-27T15:28:39Z

routes/workspace-todos.js

+    }
+    var workspaceObjId = new mongoose.Types.ObjectId(workspaceId);
+    var qSafe = Object.assign({}, q, { workspace: workspaceObjId });
+    Todo.countDocuments(qSafe).exec(function (err, total) {


NoSQL Injection

Unsanitized input from an HTTP parameter flows into countDocuments, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 105 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Data flow: 12 steps

Step 1 - 7

nodejs-goof/routes/workspace-todos.js

Line 90 in 8eab186

if (typeof req.query.priority === 'string' && VALID_PRIORITIES.indexOf(req.query.priority) !== -1) q.priority = req.query.priority;

Step 8 - 10 routes/workspace-todos.js#L104

Step 11 - 12

nodejs-goof/routes/workspace-todos.js

Line 105 in 8eab186

Todo.countDocuments(qSafe).exec(function (err, total) {

philvarner-snyk · 2026-02-27T15:28:39Z

routes/audit.js

+    }
+    AuditEvent.countDocuments(q).exec(function (err, total) {
+      if (err) return next(err);
+      AuditEvent.find(q)


NoSQL Injection

Unsanitized input from an HTTP parameter flows into find, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 72 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Data flow: 11 steps

Step 1 - 9

nodejs-goof/routes/audit.js

Line 62 in 8eab186

if (typeof req.query.action === 'string' && req.query.action.trim()) q.action = req.query.action.trim();

Step 10 - 11

nodejs-goof/routes/audit.js

Line 72 in 8eab186

AuditEvent.find(q)

philvarner-snyk · 2026-02-27T15:28:39Z

routes/workspace-todos.js

+    var qSafe = Object.assign({}, q, { workspace: workspaceObjId });
+    Todo.countDocuments(qSafe).exec(function (err, total) {
+      if (err) return next(err);
+      Todo.find(qSafe)


NoSQL Injection

Unsanitized input from an HTTP parameter flows into find, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 107 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Data flow: 12 steps

Step 1 - 7

nodejs-goof/routes/workspace-todos.js

Line 90 in 8eab186

if (typeof req.query.priority === 'string' && VALID_PRIORITIES.indexOf(req.query.priority) !== -1) q.priority = req.query.priority;

Step 8 - 10 routes/workspace-todos.js#L104

Step 11 - 12

nodejs-goof/routes/workspace-todos.js

Line 107 in 8eab186

Todo.find(qSafe)

philvarner-snyk · 2026-02-27T15:28:39Z

routes/workspaces.js

+        details: { user: newUser, role: role },
+        ip: req.ip,
+      });
+      webhookDelivery.notifyWebhooks(workspaceId, 'member.added', { resourceId: String(member._id), data: { user: newUser, role } });


NoSQL Injection

Unsanitized input from an HTTP parameter flows into find, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 219 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Data flow: 10 steps

Step 1 - 5

nodejs-goof/routes/workspaces.js

Line 195 in 8eab186

var workspaceId = req.params.id;

Step 6 routes/workspaces.js#L219

Step 7 services/webhook-delivery.js#L182

Step 8 - 10

nodejs-goof/services/webhook-delivery.js

Line 183 in 8eab186

Webhook.find({ workspace: workspaceId, active: true, events: event }).lean().exec(function (err, webhooks) {

philvarner-snyk · 2026-02-27T15:28:39Z

routes/rules.js

+    if (actErr) return res.status(400).json({ error: actErr });
+    var workspaceId = req.workspaceId;
+    var id = req.params.id;
+    Rule.findOne({ _id: id, workspace: workspaceId }).exec(function (err, rule) {


NoSQL Injection

Unsanitized input from an HTTP parameter flows into findOne, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 179 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Data flow: 9 steps

Step 1 - 5

nodejs-goof/routes/rules.js

Line 178 in 8eab186

var id = req.params.id;

Step 6 - 9

nodejs-goof/routes/rules.js

Line 179 in 8eab186

Rule.findOne({ _id: id, workspace: workspaceId }).exec(function (err, rule) {

philvarner-snyk · 2026-02-27T15:28:39Z

routes/workspaces.js

+      if (!workspaceAuth.ROLES_WITH_ADMIN.includes(membership.role)) {
+        return res.status(403).json({ error: 'Only owner or admin can add members' });
+      }
+      return WorkspaceMember.findOne({ workspace: workspaceId, user: newUser }).exec();


NoSQL Injection

Unsanitized input from an HTTP parameter flows into findOne, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 204 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Data flow: 8 steps

Step 1 - 5

nodejs-goof/routes/workspaces.js

Line 195 in 8eab186

var workspaceId = req.params.id;

Step 6 - 8

nodejs-goof/routes/workspaces.js

Line 204 in 8eab186

return WorkspaceMember.findOne({ workspace: workspaceId, user: newUser }).exec();

philvarner-snyk · 2026-02-27T15:28:39Z

routes/workspaces.js

+      if (targetUserId === actorId && membership.role === 'owner') {
+        return res.status(400).json({ error: 'Owner cannot remove themselves; transfer ownership first' });
+      }
+      return WorkspaceMember.findOneAndDelete({ workspace: workspaceId, user: targetUserId }).exec();


NoSQL Injection

Unsanitized input from an HTTP parameter flows into findOneAndDelete, where it is used in an NoSQL query. This may result in an NoSQL Injection vulnerability.

Line 242 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Data flow: 8 steps

Step 1 - 5

nodejs-goof/routes/workspaces.js

Line 231 in 8eab186

var workspaceId = req.params.id;

Step 6 - 8

nodejs-goof/routes/workspaces.js

Line 242 in 8eab186

return WorkspaceMember.findOneAndDelete({ workspace: workspaceId, user: targetUserId }).exec();

philvarner-snyk · 2026-02-27T15:28:39Z

routes/rules.js

+function validateActions(actions) {
+  if (!Array.isArray(actions)) return 'actions must be an array';
+  if (actions.length > MAX_ACTIONS) return 'At most ' + MAX_ACTIONS + ' actions per rule';
+  for (var i = 0; i < actions.length; i++) {


Unchecked Input for Loop Condition

The 0 object may not be an array, and its length property may be directly set to huge values by an attacker, which would make this loop iterate too many times. This may lead to a Denial-of-service vulnerability.

Line 44 | CWE-400 | CWE-606 | Priority score 803 | Learn more about this vulnerability

Data flow: 3 steps

Step 1 - 3

nodejs-goof/routes/rules.js

Line 44 in 8eab186

for (var i = 0; i < actions.length; i++) {

Comment out the pull_request trigger so the pipeline only runs on pushes to main/master and manual dispatch. Made-with: Cursor

Only the npm:adm-zip:20180415 (Zip Slip) vulnerability is ignored, to test visibility in the Snyk Dashboard UI. Made-with: Cursor

- Serve profile images from public/images/profiles with extension allowlist, numeric user ID validation, and path traversal checks - Add express-rate-limit dependency - Enable Snyk Code global exclude for tests/** in .snyk Pre-commit: Snyk Code scan and Snyk Open Source (SCA) scan were run on the repo. Made-with: Cursor

philvarner-snyk added 4 commits January 28, 2026 09:25

Add Snyk SCA and SAST pipeline workflows for GitHub Actions and Azure…

3037091

… DevOps

Fix SCA project name and clarify SAST monitoring behavior

7cf9dad

Add --report flag to SCA and SAST scans to persist results to Snyk Da…

416192a

…shboard

philvarner-snyk commented Feb 27, 2026

View reviewed changes

philvarner-snyk added 3 commits February 27, 2026 08:32

Disable Snyk SCA/SAST checks on pull requests

86c211f

Comment out the pull_request trigger so the pipeline only runs on pushes to main/master and manual dispatch. Made-with: Cursor

Add .snyk policy with adm-zip Zip Slip ignore

9477710

Only the npm:adm-zip:20180415 (Zip Slip) vulnerability is ignored, to test visibility in the Snyk Dashboard UI. Made-with: Cursor

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/workspaces api services#31

Feature/workspaces api services#31
philvarner-snyk wants to merge 7 commits intomainfrom
feature/workspaces-api-services

philvarner-snyk commented Feb 27, 2026

Uh oh!

philvarner-snyk commented Feb 27, 2026 •

edited

Loading

Uh oh!

philvarner-snyk Feb 27, 2026

Uh oh!

philvarner-snyk Feb 27, 2026

Uh oh!

philvarner-snyk Feb 27, 2026

Uh oh!

philvarner-snyk Feb 27, 2026

Uh oh!

philvarner-snyk Feb 27, 2026

Uh oh!

philvarner-snyk Feb 27, 2026

Uh oh!

philvarner-snyk Feb 27, 2026

Uh oh!

philvarner-snyk Feb 27, 2026

Uh oh!

philvarner-snyk Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

philvarner-snyk commented Feb 27, 2026

Uh oh!

philvarner-snyk commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⛔ Snyk checks have failed. 12 issues have been found so far.

Uh oh!

Choose a reason for hiding this comment

NoSQL Injection

Line 70 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

NoSQL Injection

Line 105 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

NoSQL Injection

Line 72 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

NoSQL Injection

Line 107 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

NoSQL Injection

Line 219 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

NoSQL Injection

Line 179 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

NoSQL Injection

Line 204 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

NoSQL Injection

Line 242 | CWE-943 | Priority score 821 | Learn more about this vulnerability

Uh oh!

Choose a reason for hiding this comment

Unchecked Input for Loop Condition

Line 44 | CWE-400 | CWE-606 | Priority score 803 | Learn more about this vulnerability

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

philvarner-snyk commented Feb 27, 2026 •

edited

Loading