code-review-nodejslisted

# Node.js / JavaScript security code review ## When it applies Reading Node/JS source (Express, Next.js, NestJS, a package). Language companion to `code-review-methodology` — the exact sinks and framework gotchas to grep and trace. ## Sinks & patterns (grep, then trace to user input) - **Command exec**: `child_process.exec`/`execSync` with user input (use `execFile`/`spawn` w/ arg array); template strings in commands. - **Code eval**: `eval`, `new Function`, `vm.runIn…`, `setTimeout("string")` — RCE. - **Prototype pollution**: recursive merge/`Object.assign`/`lodash.merge`/`set`, `JSON.parse` into object merges, query parsers — `__proto__`/`constructor` keys (→ `web-prototype-pollution`). - **SQL/NoSQL**: string-built SQL; Mongo queries taking raw `req.body`/`req.query` (operator injection `{$gt:''}`); Sequelize `.query()`/`literal`. - **SSRF**: `axios`/`fetch`/`http.get`/`request` on a user URL. - **Path/upload**: `fs.readFile`/`sendFile`/`path.join` with user paths; `res.sendFile` traversal. - **XSS (server + client)**: `res.send` of unescaped input; DOM sinks `innerHTML`, `document.write`, `dangerouslySetInnerHTML` (React), `v-html` (Vue). - **Deserialization**: `node-serialize`/`funcster` (unserialize RCE), untrusted `JSON`→object merge. ## Framework specifics - **Express**: missing `helmet`/CSP, over-broad `cors()`, `req.query`/`req.params` into sinks, weak session `secret`, no per-object authz (IDOR/BOLA), `app.use` order bypassing auth middleware. - **JWT*