From 304569fbf7b3d060e8aa37d82591df732af25226 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sun, 30 Aug 2026 09:05:54 +0000 Subject: [PATCH] bug: fix jssecurity:S2083 path traversal in routes/index.js (SonarQube AZoM-zIBs8nSf3VywcRW) Co-Authored-By: Joao Esteves --- routes/index.js | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/routes/index.js b/routes/index.js index 6b5455f03e4..b439014d659 100644 --- a/routes/index.js +++ b/routes/index.js @@ -103,8 +103,15 @@ exports.save_account_details = function(req, res, next) { profile.firstname = validator.rtrim(profile.firstname) profile.lastname = validator.rtrim(profile.lastname) - // render the view - return res.render('account.hbs', profile) + // render the view, passing only the known profile fields so that + // request data cannot override view/template resolution options + return res.render('account.hbs', { + firstname: profile.firstname, + lastname: profile.lastname, + country: profile.country, + phone: profile.phone, + email: profile.email + }) } else { // if input validation fails, we just render the view as is console.log('error in form details')