test: verify PR review comments

server.js

  }
// IMPORT: const bcrypt = require('bcrypt');
// IMPORT: const crypto = require('crypto');
// Store hashed password (in production, this should be in a database)
const ADMIN_USERNAME_HASH = crypto.createHash('sha256').update('admin').digest('hex');
const ADMIN_PASSWORD_HASH = '$2b$10$example.hash.for.admin.password'; // Replace with actual bcrypt hash
app.post("/login", async (req, res) => {
  const { username, password } = req.body;
  // Constant-time comparison for username
  const usernameHash = crypto.createHash('sha256').update(username || '').digest('hex');
  const usernameMatch = crypto.timingSafeEqual(
    Buffer.from(usernameHash, 'hex'),
    Buffer.from(ADMIN_USERNAME_HASH, 'hex')
  );
  // Constant-time comparison for password using bcrypt
  const passwordMatch = await bcrypt.compare(password || '', ADMIN_PASSWORD_HASH);
  if (usernameMatch && passwordMatch) {
    const token = jwt.sign({ role: "admin" }, JWT_SECRET);
    res.json({ token });
  } else {
    res.status(401).send("Unauthorized");
  }
});
const API_KEY = process.env.API_KEY;
const JWT_SECRET = process.env.JWT_SECRET || (() => { throw new Error('JWT_SECRET environment variable is required') })();
const DB_PASSWORD = process.env.DB_PASSWORD || (() => { throw new Error('DB_PASSWORD environment variable is required') })();
const API_KEY = process.env.API_KEY || (() => { throw new Error('API_KEY environment variable is required') })();
  const url = req.query.url;
  const allowedDomains = ['https://example.com', 'https://www.example.com'];
  const allowedPaths = ['/dashboard', '/profile', '/home'];
  if (!url) {
    return res.status(400).send('URL parameter is required');
  }
  try {
    const urlObj = new URL(url, req.protocol + '://' + req.get('host'));
    // Check if it's a relative path (same origin)
    if (url.startsWith('/') && allowedPaths.includes(url)) {
      return res.redirect(url);
    }
    // Check if it's an allowed external domain
    const fullUrl = urlObj.protocol + '//' + urlObj.host;
    if (allowedDomains.includes(fullUrl)) {
      return res.redirect(url);
    }
    // Reject all other URLs
    return res.status(400).send('Invalid redirect URL');
  } catch (error) {
    return res.status(400).send('Invalid URL format');
  }
const API_KEY = process.env.API_KEY;
const JWT_SECRET = process.env.JWT_SECRET || (() => { throw new Error('JWT_SECRET environment variable is required') })();
const DB_PASSWORD = process.env.DB_PASSWORD || (() => { throw new Error('DB_PASSWORD environment variable is required') })();
const API_KEY = process.env.API_KEY || (() => { throw new Error('API_KEY environment variable is required') })();
  const url = req.query.url;
  const allowedDomains = ['https://example.com', 'https://www.example.com'];
  const allowedPaths = ['/dashboard', '/profile', '/home'];
  if (!url) {
    return res.status(400).send('URL parameter is required');
  }
  try {
    const urlObj = new URL(url, req.protocol + '://' + req.get('host'));
    // Check if it's a relative path (same origin)
    if (url.startsWith('/') && allowedPaths.includes(url)) {
      return res.redirect(url);
    }
    // Check if it's an allowed external domain
    const fullUrl = urlObj.protocol + '//' + urlObj.host;
    if (allowedDomains.includes(fullUrl)) {
      return res.redirect(url);
    }
    // Reject all other URLs
    return res.status(400).send('Invalid redirect URL');
  } catch (error) {
    return res.status(400).send('Invalid URL format');
  }
@@ -75,3 +75,7 @@ app.get("/account/:userId", (req, res) => {
 });
 
 app.listen(3000);
+// trigger scan - verify PR review comments
+// trigger
+// trigger 1776035336
+// verify 1776049982

// IMPORT: const bcrypt = require('bcrypt');
// IMPORT: const crypto = require('crypto');
// Store hashed password (in production, this should be in a database)
const ADMIN_USERNAME_HASH = crypto.createHash('sha256').update('admin').digest('hex');
const ADMIN_PASSWORD_HASH = '$2b$10$example.hash.for.admin.password'; // Replace with actual bcrypt hash
app.post("/login", async (req, res) => {
  const { username, password } = req.body;
  // Constant-time comparison for username
  const usernameHash = crypto.createHash('sha256').update(username || '').digest('hex');
  const usernameMatch = crypto.timingSafeEqual(
    Buffer.from(usernameHash, 'hex'),
    Buffer.from(ADMIN_USERNAME_HASH, 'hex')
  );
  // Constant-time comparison for password using bcrypt
  const passwordMatch = await bcrypt.compare(password || '', ADMIN_PASSWORD_HASH);
  if (usernameMatch && passwordMatch) {
    const token = jwt.sign({ role: "admin" }, JWT_SECRET);
    res.json({ token });
  } else {
    res.status(401).send("Unauthorized");
  }
});

const API_KEY = process.env.API_KEY;

const JWT_SECRET = process.env.JWT_SECRET || (() => { throw new Error('JWT_SECRET environment variable is required') })();
const DB_PASSWORD = process.env.DB_PASSWORD || (() => { throw new Error('DB_PASSWORD environment variable is required') })();
const API_KEY = process.env.API_KEY || (() => { throw new Error('API_KEY environment variable is required') })();

  const url = req.query.url;
  const allowedDomains = ['https://example.com', 'https://www.example.com'];
  const allowedPaths = ['/dashboard', '/profile', '/home'];
  if (!url) {
    return res.status(400).send('URL parameter is required');
  }
  try {
    const urlObj = new URL(url, req.protocol + '://' + req.get('host'));
    // Check if it's a relative path (same origin)
    if (url.startsWith('/') && allowedPaths.includes(url)) {
      return res.redirect(url);
    }
    // Check if it's an allowed external domain
    const fullUrl = urlObj.protocol + '//' + urlObj.host;
    if (allowedDomains.includes(fullUrl)) {
      return res.redirect(url);
    }
    // Reject all other URLs
    return res.status(400).send('Invalid redirect URL');
  } catch (error) {
    return res.status(400).send('Invalid URL format');
  }

const API_KEY = process.env.API_KEY;

const JWT_SECRET = process.env.JWT_SECRET || (() => { throw new Error('JWT_SECRET environment variable is required') })();
const DB_PASSWORD = process.env.DB_PASSWORD || (() => { throw new Error('DB_PASSWORD environment variable is required') })();
const API_KEY = process.env.API_KEY || (() => { throw new Error('API_KEY environment variable is required') })();

  const url = req.query.url;
  const allowedDomains = ['https://example.com', 'https://www.example.com'];
  const allowedPaths = ['/dashboard', '/profile', '/home'];
  if (!url) {
    return res.status(400).send('URL parameter is required');
  }
  try {
    const urlObj = new URL(url, req.protocol + '://' + req.get('host'));
    // Check if it's a relative path (same origin)
    if (url.startsWith('/') && allowedPaths.includes(url)) {
      return res.redirect(url);
    }
    // Check if it's an allowed external domain
    const fullUrl = urlObj.protocol + '//' + urlObj.host;
    if (allowedDomains.includes(fullUrl)) {
      return res.redirect(url);
    }
    // Reject all other URLs
    return res.status(400).send('Invalid redirect URL');
  } catch (error) {
    return res.status(400).send('Invalid URL format');
  }

verify-deploy.txt

@@ -0,0 +1 @@
+Tue Apr 28 18:31:33 PDT 2026

vuln-test.js

@@ -0,0 +1,29 @@
+// Deliberately vulnerable file to verify PR review comments
+const express = require("express");
+const app = express();
+
+// Hardcoded API key - should trigger finding
+const STRIPE_KEY = "sk-test-FAKE-verify-pr-comments-1234567890abcdef";
+
+// SQL injection via string concat
+app.get("/search", (req, res) => {
+  const query = "SELECT * FROM products WHERE name = '" + req.query.q + "'";
+  db.query(query, (err, results) => res.json(results));
+});
+
+// Path traversal
+app.get("/download", (req, res) => {
+  const fs = require("fs");
+  const content = fs.readFileSync("/files/" + req.params.file, "utf8");
+  res.send(content);
+});
+
+// Open redirect
+app.get("/go", (req, res) => {
+  res.redirect(req.query.url);
+});
+
+app.listen(4000);
+// verify-pr-1776130797
+// trigger scan after blob-sha fix 1776131745
+// re-trigger after deploy confirmed live 1776131829