{ "sql-injection-query": { "src/users.js": "'use strict';\n\nfunction buildFindUserQuery(email) {\n return { text: 'SELECT id, email, name FROM users WHERE email = $1', values: [String(email)] };\n}\n\nfunction buildSearchUsersQuery(nameFragment, limit) {\n if (!Number.isInteger(limit) || limit < 1 || limit > 100) throw new RangeError('limit must be an integer from 1 to 100');\n return {\n text: \"SELECT id, email, name FROM users WHERE name ILIKE '%' || $1 || '%' ORDER BY name LIMIT $2\",\n values: [String(nameFragment), limit],\n };\n}\n\nmodule.exports = { buildFindUserQuery, buildSearchUsersQuery };\n" }, "path-traversal-guard": { "src/static.js": "'use strict';\nconst path = require('path');\n\nconst PUBLIC_ROOT = path.resolve(__dirname, '..', 'public');\n\nfunction resolvePublicPath(requestPath, root = PUBLIC_ROOT) {\n let decoded;\n try { decoded = decodeURIComponent(String(requestPath)); } catch { return null; }\n if (decoded.includes('\\0')) return null;\n const base = path.resolve(root);\n const target = path.resolve(base, '.' + path.sep + decoded);\n const rel = path.relative(base, target);\n if (rel === '') return target;\n if (rel.startsWith('..') || path.isAbsolute(rel)) return null;\n return target;\n}\n\nmodule.exports = { resolvePublicPath, PUBLIC_ROOT };\n" }, "escape-comment-html": { "src/render.js": "'use strict';\n\nconst MAP = { '&': '&', '<': '<', '>': '>', '\"': '"', \"'\": ''' };\nconst escapeHtml = value => String(value == null ? '' : value).replace(/[&<>\"']/g, ch => MAP[ch]);\n\nfunction safeHref(website) {\n try {\n const url = new URL(String(website));\n return url.protocol === 'http:' || url.protocol === 'https:' ? String(website) : '#';\n } catch { return '#'; }\n}\n\nfunction renderComment({ author, body, website }) {\n return '
' + escapeHtml(body) + '