Fix security vulnerabilities in the project

app.js

@@ -8,6 +8,7 @@ var logger = require('morgan');
 var cookieParser = require('cookie-parser');
 var bodyParser = require('body-parser');
 var log4js = require("log4js");
+var csrf = require('csurf');
 
 var init_db = require('./model/init_db');
 var login = require('./routes/login');
@@ -41,12 +42,13 @@ app.use(bodyParser.urlencoded({ extended: true }));
 app.use(cookieParser());
 app.use(express.static(path.join(__dirname, 'public')));
 app.use(session({
-  secret: 'ñasddfilhpaf78h78032h780g780fg780asg780dsbovncubuyvqy',
+  secret: process.env.SESSION_SECRET,
   cookie: {
-    secure: false,
+    secure: true,
     maxAge: 99999999999
   }
 }));
+app.use(csrf());
 
 /*
  * Routes config

model/auth.js

@@ -4,9 +4,9 @@ var config = require("../config"),
 function do_auth(username, password) {
     var db = pgp(config.db.connectionString);
 
-    var q = "SELECT * FROM users WHERE name = '" + username + "' AND password ='" + password + "';";
+    var q = "SELECT * FROM users WHERE name = $1 AND password = $2;";
 
-    return db.one(q);
+    return db.one(q, [username, password]);
 }
 
-module.exports = do_auth;
+module.exports = do_auth;

model/products.js

@@ -11,41 +11,32 @@ function list_products() {
 
 function getProduct(product_id) {
 
-    var q = "SELECT * FROM products WHERE id = '" + product_id + "';";
+    var q = "SELECT * FROM products WHERE id = $1;";
 
-    return db.one(q);
+    return db.one(q, [product_id]);
 }
 
 function search(query) {
 
-    var q = "SELECT * FROM products WHERE name ILIKE '%" + query + "%' OR description ILIKE '%" + query + "%';";
+    var q = "SELECT * FROM products WHERE name ILIKE $1 OR description ILIKE $2;";
 
-    return db.many(q);
+    return db.many(q, ['%' + query + '%', '%' + query + '%']);
 
 }
 
 function purchase(cart) {
 
-    var q = "INSERT INTO purchases(mail, product_name, user_name, product_id, address, phone, ship_date, price) VALUES('" +
-            cart.mail + "', '" +
-            cart.product_name + "', '" +
-            cart.username + "', '" +
-            cart.product_id + "', '" +
-            cart.address + "', '" +
-            cart.ship_date + "', '" +
-            cart.phone + "', '" +
-            cart.price +
-            "');";
+    var q = "INSERT INTO purchases(mail, product_name, user_name, product_id, address, phone, ship_date, price) VALUES($1, $2, $3, $4, $5, $6, $7, $8);";
 
-    return db.one(q);
+    return db.one(q, [cart.mail, cart.product_name, cart.username, cart.product_id, cart.address, cart.ship_date, cart.phone, cart.price]);
 
 }
 
 function get_purcharsed(username) {
 
-    var q = "SELECT * FROM purchases WHERE user_name = '" + username + "';";
+    var q = "SELECT * FROM purchases WHERE user_name = $1;";
 
-    return db.many(q);
+    return db.many(q, [username]);
 
 }
 

routes/login.js

@@ -22,14 +22,17 @@ router.post('/login/auth', function(req, res) {
     var password = req.body.password;
     var returnurl = req.body.returnurl;
 
-    logger.error("Tried to login attempt from user = " + user);
+    // Sanitize user input before logging
+    var sanitizedUser = user.replace(/[^a-zA-Z0-9]/g, '');
+    logger.error("Tried to login attempt from user = " + sanitizedUser);
 
     auth(user, password)
         .then(function (data) {
             req.session.logged = true;
             req.session.user_name = user;
 
-            if (returnurl == undefined || returnurl == ""){
+            // Validate the return URL
+            if (!returnurl || !returnurl.startsWith('/')) {
                 returnurl = "/";
             }