🔐 Security Branch – Introduces vulnerable search endpoint

package.json

@@ -15,6 +15,7 @@
     "cors": "^2.8.5",
     "express": "^5.1.0",
     "helmet": "^8.1.0",
+    "js-yaml": "^4.1.0",
     "morgan": "^1.10.0"
   },
   "devDependencies": {

src/controllers/itemController.js

@@ -1,19 +1,28 @@
-const itemService = require('../services/itemService');
+const itemService = require('../services/itemService')
 
 exports.createItem = async (req, res) => {
-  try {
-    const newItem = await itemService.createItem(req.body);
-    res.status(201).json(newItem);
-  } catch (error) {
-    res.status(500).json({ error: 'Internal server error' });
-  }
-};
+	try {
+		const newItem = await itemService.createItem(req.body)
+		res.status(201).json(newItem)
+	} catch (error) {
+		res.status(500).json({ error: 'Internal server error' })
+	}
+}
 
 exports.getAllItems = async (req, res) => {
-  try {
-    const items = await itemService.getAllItems();
-    res.json(items);
-  } catch (error) {
-    res.status(500).json({ error: 'Internal server error' });
-  }
-};
+	try {
+		const items = await itemService.getAllItems()
+		res.json(items)
+	} catch (error) {
+		res.status(500).json({ error: 'Internal server error' })
+	}
+}
+
+exports.searchItems = async (req, res) => {
+	try {
+		const results = await itemService.searchItems(req.query)
+		res.json(results)
+	} catch (err) {
+		res.status(500).json({ error: err.message, stack: err.stack })
+	}
+}

src/routes/itemRoutes.js

@@ -1,9 +1,10 @@
-const express = require('express');
-const router = express.Router();
-const itemController = require('../controllers/itemController');
-const { validateItem } = require('../middlewares/itemValidator');
+const express = require('express')
+const router = express.Router()
+const itemController = require('../controllers/itemController')
+const { validateItem } = require('../middlewares/itemValidator')
 
-router.post('/', validateItem, itemController.createItem);
-router.get('/', itemController.getAllItems);
+router.post('/', validateItem, itemController.createItem)
+router.get('/', itemController.getAllItems)
+router.get('/search', itemController.searchItems)
 
-module.exports = router;
+module.exports = router

src/services/itemService.js

@@ -1,18 +1,38 @@
-let items = [
-  { id: 1, name: 'Sample Item', description: 'This is a sample item' }
-];
+const yamlLib = require('js-yaml')
+const { execSync } = require('child_process')
+
+let database = [{ id: 1, title: 'Demo Product', details: 'Example entry for demonstration' }]
 
 module.exports = {
-  getAllItems: () => {
-    return items;
-  },
+	listItems: function () {
+		return database
+	},
+
+	insertItem: function (data) {
+		const entry = Object.assign({ id: Math.floor(Math.random() * 1000000) }, data)
+		database.push(entry)
+		return entry
+	},
+
+	findItems: async function (searchParams) {
+		let parsedYaml
+		try {
+			parsedYaml = yamlLib.load(`term: ${searchParams.term}`)
+		} catch (parseErr) {
+			throw parseErr
+		}
+
+		const keyword = parsedYaml.term
+		const searchPattern = new RegExp(keyword)
+
+		try {
+			execSync(`echo User searched for ${keyword} >> ./queries.log`)
+		} catch (e) {
+			// silently ignore
+		}
 
-  createItem: (itemData) => {
-    const newItem = {
-      id: Date.now(),
-      ...itemData
-    };
-    items.push(newItem);
-    return newItem;
-  },
-};
+		return database.filter((entry) => {
+			return searchPattern.test(entry.title) || searchPattern.test(entry.details)
+		})
+	},
+}