gitea_admin/pragent
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

test: e2e review target (eval + secret leak) #3

Closed
pragent-bot wants to merge 1 commits from pragent-e2e-test into main
pull from: pragent-e2e-test
merge into: gitea_admin:main
Conversation 1 Commits 1 Files Changed 1
+7
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test-e2e/bug.ts
+7
View File
@@ -0,0 +1,7 @@
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[CRITICAL] eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything.

Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new RangeError(`parseAmount: not a finite number: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything. Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new RangeError(`parseAmount: not a finite number: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[HIGH] process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface.

Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter.

export function loadToken(): string {
  const token = process.env.SECRET_TOKEN;
  if (!token) {
    throw new Error('SECRET_TOKEN is not set');
  }
  return token;
}

📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

**[HIGH]** process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface. Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter. ```suggestion export function loadToken(): string { const token = process.env.SECRET_TOKEN; if (!token) { throw new Error('SECRET_TOKEN is not set'); } return token; } ``` 📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[CRITICAL] eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything.

Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new RangeError(`parseAmount: not a finite number: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything. Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new RangeError(`parseAmount: not a finite number: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[HIGH] process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface.

Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter.

export function loadToken(): string {
  const token = process.env.SECRET_TOKEN;
  if (!token) {
    throw new Error('SECRET_TOKEN is not set');
  }
  return token;
}

📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

**[HIGH]** process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface. Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter. ```suggestion export function loadToken(): string { const token = process.env.SECRET_TOKEN; if (!token) { throw new Error('SECRET_TOKEN is not set'); } return token; } ``` 📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information
export function parseAmount(input: string): number {
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[CRITICAL] eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything.

Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new RangeError(`parseAmount: not a finite number: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything. Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new RangeError(`parseAmount: not a finite number: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[HIGH] process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface.

Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter.

export function loadToken(): string {
  const token = process.env.SECRET_TOKEN;
  if (!token) {
    throw new Error('SECRET_TOKEN is not set');
  }
  return token;
}

📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

**[HIGH]** process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface. Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter. ```suggestion export function loadToken(): string { const token = process.env.SECRET_TOKEN; if (!token) { throw new Error('SECRET_TOKEN is not set'); } return token; } ``` 📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information
return eval(input);
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[CRITICAL] eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything.

Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new RangeError(`parseAmount: not a finite number: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything. Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new RangeError(`parseAmount: not a finite number: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[HIGH] process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface.

Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter.

export function loadToken(): string {
  const token = process.env.SECRET_TOKEN;
  if (!token) {
    throw new Error('SECRET_TOKEN is not set');
  }
  return token;
}

📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

**[HIGH]** process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface. Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter. ```suggestion export function loadToken(): string { const token = process.env.SECRET_TOKEN; if (!token) { throw new Error('SECRET_TOKEN is not set'); } return token; } ``` 📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information
}
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[CRITICAL] eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything.

Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new RangeError(`parseAmount: not a finite number: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything. Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new RangeError(`parseAmount: not a finite number: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[HIGH] process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface.

Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter.

export function loadToken(): string {
  const token = process.env.SECRET_TOKEN;
  if (!token) {
    throw new Error('SECRET_TOKEN is not set');
  }
  return token;
}

📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

**[HIGH]** process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface. Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter. ```suggestion export function loadToken(): string { const token = process.env.SECRET_TOKEN; if (!token) { throw new Error('SECRET_TOKEN is not set'); } return token; } ``` 📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[CRITICAL] eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything.

Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new RangeError(`parseAmount: not a finite number: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything. Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new RangeError(`parseAmount: not a finite number: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[HIGH] process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface.

Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter.

export function loadToken(): string {
  const token = process.env.SECRET_TOKEN;
  if (!token) {
    throw new Error('SECRET_TOKEN is not set');
  }
  return token;
}

📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

**[HIGH]** process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface. Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter. ```suggestion export function loadToken(): string { const token = process.env.SECRET_TOKEN; if (!token) { throw new Error('SECRET_TOKEN is not set'); } return token; } ``` 📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information
export function loadToken(): string {
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[CRITICAL] eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything.

Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new RangeError(`parseAmount: not a finite number: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything. Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new RangeError(`parseAmount: not a finite number: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[HIGH] process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface.

Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter.

export function loadToken(): string {
  const token = process.env.SECRET_TOKEN;
  if (!token) {
    throw new Error('SECRET_TOKEN is not set');
  }
  return token;
}

📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

**[HIGH]** process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface. Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter. ```suggestion export function loadToken(): string { const token = process.env.SECRET_TOKEN; if (!token) { throw new Error('SECRET_TOKEN is not set'); } return token; } ``` 📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information
return process.env.SECRET_TOKEN;
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[CRITICAL] eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything.

Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new RangeError(`parseAmount: not a finite number: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything. Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new RangeError(`parseAmount: not a finite number: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[HIGH] process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface.

Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter.

export function loadToken(): string {
  const token = process.env.SECRET_TOKEN;
  if (!token) {
    throw new Error('SECRET_TOKEN is not set');
  }
  return token;
}

📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

**[HIGH]** process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface. Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter. ```suggestion export function loadToken(): string { const token = process.env.SECRET_TOKEN; if (!token) { throw new Error('SECRET_TOKEN is not set'); } return token; } ``` 📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information
}
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[CRITICAL] eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything.

Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new RangeError(`parseAmount: not a finite number: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything. Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new RangeError(`parseAmount: not a finite number: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval
pragent-bot commented 2026-08-17 22:56:58 +00:00
Review
Copy Link
Copy Source

[HIGH] process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface.

Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter.

export function loadToken(): string {
  const token = process.env.SECRET_TOKEN;
  if (!token) {
    throw new Error('SECRET_TOKEN is not set');
  }
  return token;
}

📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

**[HIGH]** process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface. Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter. ```suggestion export function loadToken(): string { const token = process.env.SECRET_TOKEN; if (!token) { throw new Error('SECRET_TOKEN is not set'); } return token; } ``` 📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information