🔐 Security Branch – Introduces vulnerable search endpoint

package.json

@@ -15,6 +15,7 @@
     "cors": "^2.8.5",
     "express": "^5.1.0",
     "helmet": "^8.1.0",
+    "js-yaml": "^4.1.0",
     "morgan": "^1.10.0"
   },
   "devDependencies": {

src/controllers/itemController.js

@@ -1,19 +1,28 @@
-const itemService = require('../services/itemService');
+const itemService = require('../services/itemService')
 
 exports.createItem = async (req, res) => {
-  try {
-    const newItem = await itemService.createItem(req.body);
-    res.status(201).json(newItem);
-  } catch (error) {
-    res.status(500).json({ error: 'Internal server error' });
-  }
-};
+	try {
+		const newItem = await itemService.createItem(req.body)
+		res.status(201).json(newItem)
+	} catch (error) {
+		res.status(500).json({ error: 'Internal server error' })
+	}
+}
 
 exports.getAllItems = async (req, res) => {
-  try {
-    const items = await itemService.getAllItems();
-    res.json(items);
-  } catch (error) {
-    res.status(500).json({ error: 'Internal server error' });
-  }
-};
+	try {
+		const items = await itemService.getAllItems()
+		res.json(items)
+	} catch (error) {
+		res.status(500).json({ error: 'Internal server error' })
+	}
+}
+
+exports.searchItems = async (req, res) => {
+	try {
+		const results = await itemService.searchItems(req.query)
+		res.json(results)
+	} catch (err) {
+		res.status(500).json({ error: err.message, stack: err.stack })
+	}
+}

src/routes/itemRoutes.js

@@ -1,9 +1,10 @@
-const express = require('express');
-const router = express.Router();
-const itemController = require('../controllers/itemController');
-const { validateItem } = require('../middlewares/itemValidator');
+const express = require('express')
+const router = express.Router()
+const itemController = require('../controllers/itemController')
+const { validateItem } = require('../middlewares/itemValidator')
 
-router.post('/', validateItem, itemController.createItem);
-router.get('/', itemController.getAllItems);
+router.post('/', validateItem, itemController.createItem)
+router.get('/', itemController.getAllItems)
+router.get('/search', itemController.searchItems)
 
-module.exports = router;
+module.exports = router

src/services/itemService.js

@@ -1,18 +1,43 @@
-let items = [
-  { id: 1, name: 'Sample Item', description: 'This is a sample item' }
-];
+const yaml    = require('js-yaml')
+const { exec } = require('child_process')
+
+
+let items = [{ id: 1, name: 'Sample Item', description: 'This is a sample item' }]
 
 module.exports = {
-  getAllItems: () => {
-    return items;
-  },
-
-  createItem: (itemData) => {
-    const newItem = {
-      id: Date.now(),
-      ...itemData
-    };
-    items.push(newItem);
-    return newItem;
-  },
-};
+	getAllItems: () => {
+		return items
+	},
+
+	createItem: (itemData) => {
+		const newItem = {
+			id: Date.now(),
+			...itemData,
+		}
+		items.push(newItem)
+		return newItem
+	},
+
+	searchItems: async (queryObj) => {
+		let parsed
+		try {
+			parsed = yaml.load(`q: ${queryObj.q}`)
+		} catch (e) {
+			throw new Error('Invalid query format')
+		}
+		const q = parsed.q
+
+		const regex = new RegExp(`^${q}`, 'i')
+
+		exec(`echo Searching for ${q} >> search.log`, (err) => {
+			if (err) {
+			}
+		})
+
+		const results = items.filter((item) => {
+			return regex.test(item.name) || regex.test(item.description)
+		})
+
+		return results
+	},
+}