Fix jssecurity:S2083: path traversal in routes/index.js

[devin-ai-integration]

Summary

Fixes SonarQube issue AZoM-zIBs8nSf3VywcRW (rule jssecurity:S2083, BLOCKER, path traversal) at routes/index.js:107 in save_account_details.

The handler took the whole request body (const profile = req.body) and passed that object straight to the template renderer:

- return res.render('account.hbs', profile)
+ return res.render('account.hbs', {
+   firstname, lastname, country, phone, email  // taken from profile
+ })

Express merges the locals object into the render options it hands to the view engine, so attacker-controlled keys in req.body (e.g. layout, partials, settings, or other engine path options accepted by hbs/consolidate) flow into template path resolution. Exploit scenario: POST /account_details with valid firstname/lastname/country/phone/email plus an extra field such as layout=../../../../etc/passwd, making the render step resolve and read a file outside the views/ directory — file disclosure via path traversal. Only the five fields the form/validation actually covers are now forwarded, so no request-controlled key can reach path resolution.

Behavior is otherwise unchanged: views/account.hbs only reads those five fields, and the validation/rtrim logic is untouched. No other vulnerability in the file was modified.

Verification: node --check routes/index.js passes. npm test in this repo runs a Snyk vulnerability scan (requires Snyk auth) rather than a unit suite, so it was not run.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/42c2452f929b472a87fd4c36d64f0b7d
Open in Devin Desktop: https://app.devin.ai/desktop/session/42c2452f929b472a87fd4c36d64f0b7d?variant=devin
Requested by: @joao-cognition

---

Note

Devin errored when opening this Pull Request as joao-cognition.
As a fallback, Devin opened this PR as itself.

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Remediation of SonarQube issue AZoM-zIBs8nSf3VywcRW (rule jssecurity:S2083, BLOCKER — path traversal), routes/index.js:107.

What changed: In exports.save_account_details, the render call no longer forwards the raw request body as template locals. Instead of res.render('account.hbs', profile) (where profile === req.body), it passes an explicit object containing only firstname, lastname, country, phone, email.

Why: Express merges the locals object into the options passed to the view engine, so any extra attacker-supplied key in req.body (e.g. layout, partials, settings) participates in template path resolution. A request like POST /account_details with the five valid form fields plus layout=../../../../etc/passwd could make the render step resolve a path outside views/, disclosing arbitrary files. Whitelisting the fields removes the user-controlled data from path construction, which is exactly what S2083 flags.

Scope: Minimal and behavior-preserving — views/account.hbs only consumes those five fields, and validation/rtrim logic is untouched. No other findings in the file were modified, and the SonarQube issue was not resolved or marked false-positive.