Code Injection

// Node.js/Express - SECURE implementation without code injection

// Define allowed operations explicitly (whitelist approach)
const ALLOWED_OPERATIONS = {
  add: (a, b) => a + b,
  subtract: (a, b) => a - b,
  multiply: (a, b) => a * b,
  divide: (a, b) => b !== 0 ? a / b : null
};

app.get('/calc', (req, res) => {
  try {
    const { op, a, b } = req.query;
    
    // SECURE: Check operation against whitelist
    if (!Object.prototype.hasOwnProperty.call(ALLOWED_OPERATIONS, op)) {
      return res.status(400).json({ error: 'Unsupported operation' });
    }
    
    // SECURE: Parse and validate inputs as numbers
    const numA = Number(a);
    const numB = Number(b);
    
    if (!Number.isFinite(numA) || !Number.isFinite(numB)) {
      return res.status(400).json({ error: 'Invalid numeric arguments' });
    }
    
    // Execute whitelisted operation
    const result = ALLOWED_OPERATIONS[op](numA, numB);
    
    if (result === null) {
      return res.status(400).json({ error: 'Division by zero' });
    }
    
    res.json({ result });
  } catch (err) {
    res.status(500).json({ error: 'Server error' });
  }
});

// SECURE: Static template with no user-controlled code
app.post('/preview-template', (req, res) => {
  // Use a predefined template, only allow data substitution
  const templateData = {
    username: String(req.body.username || ''),
    message: String(req.body.message || '')
  };
  
  // SECURE: Template is static, only data is dynamic
  const staticTemplate = '<h1>Hello <%= username %></h1><p><%= message %></p>';
  const ejs = require('ejs');
  const rendered = ejs.render(staticTemplate, templateData);
  res.send(rendered);
});

// SECURE: Fixed discount logic, no dynamic evaluation
const DISCOUNT_TIERS = {
  bronze: 0.05,
  silver: 0.10,
  gold: 0.15,
  platinum: 0.20
};

app.post('/api/calculate-discount', (req, res) => {
  const tier = String(req.body.tier || 'bronze');
  const price = Number(req.body.price);
  
  // SECURE: Use predefined discount rates
  const discountRate = DISCOUNT_TIERS[tier] || 0;
  const discount = price * discountRate;
  
  res.json({ discount, tier, rate: discountRate });
});