ansede-static Security Report

app\assets\js\chart\chart-data-morris.js [javascript] clean ▼

ERRORTimed out after 30s

app\assets\js\tour\redirects-steps.js [javascript] clean ▼

✅ No issues found — 29 lines scanned

app\assets\vendor\bootstrap\bootstrap-tour.js [javascript] 1 finding ▼

MEDIUM L255 CWE-1333: Potential ReDoS — catastrophic backtracking regex at line 255 — CWE-1333

Regex with nested quantifiers or ambiguous alternation at L255: `this._debug("Paused/Stopped step " + (this._current + 1) + " timer (" + this._duration + "`.

this._debug("Paused/Stopped step " + (this._current + 1) + " timer (" + this._duration + " remaining).");

💡 Use safe regex patterns or a non-backtracking engine.

JS-024 confidence 100% securitypattern

app\assets\vendor\bootstrap\bootstrap.js [javascript] 2 findings ▼

HIGH L11 CWE-1321: Prototype pollution risk at line 11 — CWE-1321

Object modification using `__proto__`, `constructor.prototype`, or `Object.assign` with unchecked user input at L11: `+function(a){"use strict";var b='[data-dismiss="alert"]',c=function(c){a(c).on("click",b,t`.

💡 Validate keys, strip `__proto__` / `constructor`, and prefer safe merge patterns.

JS-018 confidence 100% securitypattern

MEDIUM L11 CWE-1333: Potential ReDoS — catastrophic backtracking regex at line 11 — CWE-1333

Regex with nested quantifiers or ambiguous alternation at L11: `+function(a){"use strict";var b='[data-dismiss="alert"]',c=function(c){a(c).on("click",b,t`.

💡 Use safe regex patterns or a non-backtracking engine.

JS-024 confidence 100% securitypattern

app\assets\vendor\chart\morris-0.4.3.min.js [javascript] 1 finding ▼

MEDIUM L1 CWE-1333: Potential ReDoS — catastrophic backtracking regex at line 1 — CWE-1333

Regex with nested quantifiers or ambiguous alternation at L1: `(function(){var e,t,n,r,i=[].slice,s={}.hasOwnProperty,o=function(e,t){function r(){this.c`.

💡 Use safe regex patterns or a non-backtracking engine.

JS-024 confidence 100% securitypattern

app\assets\vendor\chart\raphael-min.js [javascript] clean ▼

ERRORTimed out after 30s

app\assets\vendor\html5shiv.js [javascript] 2 findings ▼

CRITICAL L6 CWE-79: XSS via innerHTML assignment at line 6 — CWE-79

Unsanitized data assigned to `innerHTML` or `outerHTML` at L6: `c=d.insertBefore(c.lastChild,d.firstChild);b.hasCSS=!!c}g||t(a,b);return a}var k=l.html5||`. An attacker can inject a `<script>` tag or event handler that executes in the victim's browser.

c=d.insertBefore(c.lastChild,d.firstChild);b.hasCSS=!!c}g||t(a,b);return a}var k=l.html5||{},s=/^<|^(?:button|map|select|textarea|object|iframe|option|optgroup)$/i,r=/^(?:a|b|code|div|fieldset|h1|h2|h3|h4|h5|h6|i|label|li|ol|p|q|span|strong|style|table|tbody|td|th|tr|ul)$/i,j,o="_html5shiv",h=0,n={},g;(function(){try{var a=f.createElement("a");a.innerHTML="<xyz></xyz>";j="hidden"in a;var b;if(!(b=1==a.childNodes.length)){f.createElement("a");var c=f.createDocumentFragment();b="undefined"==typeof c.cloneNode||

💡 Use `textContent` instead of `innerHTML`, or sanitize with DOMPurify.sanitize(). Never concatenate user data into HTML.

JS-001 confidence 100% securitypattern

MEDIUM L5 CWE-1333: Potential ReDoS — catastrophic backtracking regex at line 5 — CWE-1333

Regex with nested quantifiers or ambiguous alternation at L5: `a.createElement=function(c){return!e.shivMethods?b.createElem(c):p(c,a,b)};a.createDocumen`.

a.createElement=function(c){return!e.shivMethods?b.createElem(c):p(c,a,b)};a.createDocumentFragment=Function("h,f","return function(){var n=f.cloneNode(),c=n.createElement;h.shivMethods&&("+m().join().replace(/\w+/g,function(a){b.createElem(a);b.frag.createElement(a);return'c("'+a+'")'})+");return n}")(e,b.frag)}function q(a){a||(a=f);var b=i(a);if(e.shivCSS&&!j&&!b.hasCSS){var c,d=a;c=d.createElement("p");d=d.getElementsByTagName("head")[0]||d.documentElement;c.innerHTML="x<style>article,aside,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}mark{background:#FF0;color:#000}</style>";

💡 Use safe regex patterns or a non-backtracking engine.

JS-024 confidence 100% securitypattern

app\assets\vendor\jquery.min.js [javascript] clean ▼

ERRORTimed out after 30s

app\data\allocations-dao.js [javascript] clean ▼

✅ No issues found — 114 lines scanned

app\data\benefits-dao.js [javascript] clean ▼

✅ No issues found — 43 lines scanned

app\data\contributions-dao.js [javascript] clean ▼

✅ No issues found — 86 lines scanned

app\data\memos-dao.js [javascript] clean ▼

✅ No issues found — 39 lines scanned

app\data\profile-dao.js [javascript] clean ▼

✅ No issues found — 113 lines scanned

app\data\research-dao.js [javascript] clean ▼

✅ No issues found — 27 lines scanned

app\data\user-dao.js [javascript] 1 finding ▼

MEDIUM L53 CWE-338: Weak PRNG (Math.random) in security context at line 53 — CWE-338

`Math.random()` used near security-sensitive code at L53: `const year = Math.ceil(Math.random() * 30) + today.getFullYear();`. Math.random is NOT cryptographically secure.

const year = Math.ceil(Math.random() * 30) + today.getFullYear();

💡 Use `crypto.randomBytes(32)` (Node.js) or `crypto.getRandomValues()` (browser).

JS-016 confidence 100% securitypattern

app\routes\allocations.js [javascript] clean ▼

✅ No issues found — 34 lines scanned

app\routes\benefits.js [javascript] clean ▼

✅ No issues found — 57 lines scanned

app\routes\contributions.js [javascript] 3 findings ▼

CRITICAL L32 CWE-95: Code injection via eval() at line 32 — CWE-95

`eval()` is called with dynamic content at L32: `eval(req.body.preTax)`. If the argument is attacker-influenced, arbitrary JavaScript can execute.

const preTax = eval(req.body.preTax);

💡 Remove `eval()`. Parse data with `JSON.parse()` or use a safe expression interpreter.

JS-004 confidence 96% securitysyntax-ast

CRITICAL L33 CWE-95: Code injection via eval() at line 33 — CWE-95

`eval()` is called with dynamic content at L33: `eval(req.body.afterTax)`. If the argument is attacker-influenced, arbitrary JavaScript can execute.

const afterTax = eval(req.body.afterTax);

💡 Remove `eval()`. Parse data with `JSON.parse()` or use a safe expression interpreter.

JS-004 confidence 96% securitysyntax-ast

CRITICAL L34 CWE-95: Code injection via eval() at line 34 — CWE-95

`eval()` is called with dynamic content at L34: `eval(req.body.roth)`. If the argument is attacker-influenced, arbitrary JavaScript can execute.

const roth = eval(req.body.roth);

💡 Remove `eval()`. Parse data with `JSON.parse()` or use a safe expression interpreter.

JS-004 confidence 96% securitysyntax-ast

app\routes\error.js [javascript] clean ▼

✅ No issues found — 15 lines scanned

app\routes\index.js [javascript] 10 findings ▼

HIGH L72 CWE-601: Open redirect via tainted variable at line 72 — CWE-601

`res.redirect()` at L72 uses a user-influenced destination: `res.redirect(req.query.url)`. Attackers can redirect victims to untrusted sites.

return res.redirect(req.query.url);

💡 Validate redirect targets against an allowlist of permitted relative paths or trusted hosts.

JS-039 confidence 96% securitysyntax-ast

HIGH L72 CWE-601: Open redirect via user-controlled URL at line 72 — CWE-601

`res.redirect()` uses value from `req.query`, `req.body`, or `req.params` at L72: `return res.redirect(req.query.url);`. An attacker can redirect users to a phishing site.

return res.redirect(req.query.url);

💡 Validate redirect target against an allowlist of permitted URLs or paths.

JS-014 confidence 100% securitypattern

MEDIUM L34 CWE-352: State-mutating route may lack CSRF protection at line 34 — CWE-352

POST/PUT/PATCH/DELETE route defined at L34 (`app.post("/login", sessionHandler.handleLoginRequest);`). Without CSRF protection, authenticated users can be tricked into submitting unwanted requests.

app.post("/login", sessionHandler.handleLoginRequest);