OWASP Top 10 for developers

docker run -d --rm --name owasp-lab -e POSTGRES_PASSWORD=test -p 55432:5432 postgres:17-alpine
docker exec owasp-lab psql -U postgres -c "CREATE DATABASE owasp_demo"
docker exec -i owasp-lab psql -U postgres -d owasp_demo < db/schema.sql

npm init -y && npm pkg set type=module
npm install express@5 pg@8
npm pkg set scripts.test="node --test --test-concurrency=1"
npm test

docker stop owasp-lab

CREATE TABLE users (
  id            integer PRIMARY KEY,
  email         text NOT NULL UNIQUE,
  role          text NOT NULL CHECK (role IN ('manager', 'admin')),
  password_hash text NOT NULL
);

CREATE TABLE leads (
  id         integer GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
  owner_id   integer NOT NULL REFERENCES users (id),
  name       text NOT NULL,
  phone      text NOT NULL,
  created_at timestamptz NOT NULL DEFAULT now()
);

INSERT INTO users VALUES
  (1, 'aigerim@example.com', 'manager', 'scrypt$demo-hash-1'),
  (2, 'daniyar@example.com', 'manager', 'scrypt$demo-hash-2'),
  (3, 'admin@example.com',   'admin',   'scrypt$demo-hash-3');

INSERT INTO leads (owner_id, name, phone) VALUES
  (1, 'Coffee shop on Abay', '+77010000001'),
  (1, 'Dental clinic',       '+77010000002'),
  (2, 'Beauty salon',        '+77010000003');

import pg from "pg";

export const pool = new pg.Pool({
  connectionString: process.env.DATABASE_URL ?? "postgres://postgres:test@localhost:55432/owasp_demo",
});

export async function serve(app) {
  const server = await new Promise((resolve) => {
    const s = app.listen(0, () => resolve(s));
  });
  const base = `http://localhost:${server.address().port}`;
  return { base, close: () => new Promise((resolve) => server.close(resolve)) };
}

// TRAINING EXAMPLE, VULNERABLE: any signed-in user can read any lead by id (IDOR).
export async function getLeadVulnerable(pool, user, id) {
  const { rows } = await pool.query("SELECT id, owner_id, name, phone FROM leads WHERE id = $1", [id]);
  return rows[0] ?? null;
}

// Fixed: ownership is part of the query; admins see everything.
export async function getLead(pool, user, id) {
  const { rows } = await pool.query(
    "SELECT id, owner_id, name, phone FROM leads WHERE id = $1 AND (owner_id = $2 OR $3 = 'admin')",
    [id, user.id, user.role],
  );
  return rows[0] ?? null;
}

// SSRF is part of A01 since 2025: the server fetches only allow-listed hosts.
const ALLOWED_HOSTS = new Set(["api.partner.example"]);

export function assertAllowedUrl(input) {
  const url = new URL(input);
  if (url.protocol !== "https:" || !ALLOWED_HOSTS.has(url.hostname)) {
    throw new Error(`URL not allowed: ${url.origin}`);
  }
  return url;
}

import assert from "node:assert/strict";
import { after, test } from "node:test";
import { assertAllowedUrl, getLead, getLeadVulnerable } from "../src/a01-access.js";
import { pool } from "../support/http-db.js";

after(() => pool.end());

const aigerim = { id: 1, role: "manager" };
const admin = { id: 3, role: "admin" };
const daniyarLeadId = 3;

test("IDOR: the vulnerable version returns someone else's lead", async () => {
  const lead = await getLeadVulnerable(pool, aigerim, daniyarLeadId);
  assert.equal(lead.name, "Beauty salon");
});

test("the fixed version hides other owners' leads but not from admins", async () => {
  assert.equal(await getLead(pool, aigerim, daniyarLeadId), null);
  assert.equal((await getLead(pool, aigerim, 1)).name, "Coffee shop on Abay");
  assert.equal((await getLead(pool, admin, daniyarLeadId)).name, "Beauty salon");
});

test("SSRF guard accepts only allow-listed https hosts", () => {
  assert.equal(assertAllowedUrl("https://api.partner.example/v1/rates").hostname, "api.partner.example");
  for (const bad of [
    "http://api.partner.example/v1",
    "https://169.254.169.254/latest/meta-data/",
    "https://api.partner.example.evil.test/",
    "file:///etc/passwd",
  ]) {
    assert.throws(() => assertAllowedUrl(bad), /not allowed/);
  }
});

// TRAINING EXAMPLE, VULNERABLE: user input is concatenated into SQL text.
export async function searchLeadsVulnerable(pool, ownerId, q) {
  const sql = `SELECT id, name, phone FROM leads WHERE owner_id = ${ownerId} AND name ILIKE '%${q}%'`;
  const { rows } = await pool.query(sql);
  return rows;
}

// Fixed: the query text is constant, values travel separately as parameters.
export async function searchLeads(pool, ownerId, q) {
  const { rows } = await pool.query(
    "SELECT id, name, phone FROM leads WHERE owner_id = $1 AND name ILIKE '%' || $2 || '%'",
    [ownerId, q],
  );
  return rows;
}

// Column names cannot be parameters: pick them from an allow-list.
const SORTABLE = new Map([
  ["name", "name"],
  ["newest", "created_at DESC"],
]);

export async function listLeads(pool, ownerId, sort) {
  const orderBy = SORTABLE.get(sort) ?? "created_at DESC";
  const { rows } = await pool.query(`SELECT id, name FROM leads WHERE owner_id = $1 ORDER BY ${orderBy}`, [
    ownerId,
  ]);
  return rows;
}

import assert from "node:assert/strict";
import { after, test } from "node:test";
import { listLeads, searchLeads, searchLeadsVulnerable } from "../src/a05-injection.js";
import { pool } from "../support/http-db.js";

after(() => pool.end());

const OR_TRUE = "' OR 1=1 --";
const UNION = "' UNION SELECT id, email, password_hash FROM users --";

test("vulnerable search: OR 1=1 returns other managers' leads", async () => {
  const rows = await searchLeadsVulnerable(pool, 1, OR_TRUE);
  console.log("OR 1=1  →", rows.map((r) => r.name));
  assert.equal(rows.length, 3);
});

test("vulnerable search: UNION leaks the users table", async () => {
  const rows = await searchLeadsVulnerable(pool, 1, UNION);
  console.log("UNION   →", rows.map((r) => `${r.name} ${r.phone}`));
  assert.ok(rows.some((r) => r.name === "admin@example.com"));
});

test("parameterized search treats the payload as plain text", async () => {
  assert.deepEqual(await searchLeads(pool, 1, OR_TRUE), []);
  assert.deepEqual(await searchLeads(pool, 1, UNION), []);
  const rows = await searchLeads(pool, 1, "coffee");
  assert.deepEqual(rows.map((r) => r.name), ["Coffee shop on Abay"]);
});

test("sort column comes from an allow-list", async () => {
  const rows = await listLeads(pool, 1, "name; DROP TABLE leads --");
  assert.equal(rows.length, 2);
  const byName = await listLeads(pool, 1, "name");
  assert.deepEqual(byName.map((r) => r.name), ["Coffee shop on Abay", "Dental clinic"]);
});

$ npm test
…
OR 1=1  → [ 'Coffee shop on Abay', 'Dental clinic', 'Beauty salon' ]
✔ vulnerable search: OR 1=1 returns other managers' leads (29.0166ms)
UNION   → [
  'daniyar@example.com scrypt$demo-hash-2',
  'Dental clinic +77010000002',
  'Coffee shop on Abay +77010000001',
  'aigerim@example.com scrypt$demo-hash-1',
  'admin@example.com scrypt$demo-hash-3'
]
✔ vulnerable search: UNION leaks the users table (3.6767ms)
✔ parameterized search treats the payload as plain text (4.9012ms)
✔ sort column comes from an allow-list (3.4683ms)

// TRAINING EXAMPLE, VULNERABLE: the query string is inserted into HTML as is.
export function renderSearchVulnerable(q) {
  return `<p>Results for: ${q}</p>`;
}

export function escapeHtml(value) {
  return String(value).replace(
    /[&<>"']/g,
    (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch],
  );
}

// Fixed: HTML entity encoding for the HTML body context.
export function renderSearch(q) {
  return `<p>Results for: ${escapeHtml(q)}</p>`;
}

$ npm test
…
vulnerable: <p>Results for: <script>alert(document.cookie)</script></p>
fixed:      <p>Results for: &lt;script&gt;alert(document.cookie)&lt;/script&gt;</p>

$ node support/browser-check.mjs   # Playwright 1.64 + Chromium
SRI original  → typeof dayjs: function
SRI tampered  → typeof dayjs: undefined
console error: Failed to find a valid digest in the 'integrity' attribute for resource 'https://cdn.jsdelivr.net/npm/dayjs@1.11.23/dayjs.min.js' with computed SHA-384 integrit
XSS, no CSP   → title: "pwned"
XSS, with CSP → title: ""
console error: Executing inline script violates the following Content Security Policy directive 'default-src 'self''. Either the 'unsafe-inline' keyword, a hash ('sha256-OOZdo

import { createHash, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
import { promisify } from "node:util";

// TRAINING EXAMPLE, VULNERABLE: a fast hash without salt.
export function hashPasswordVulnerable(password) {
  return createHash("sha256").update(password).digest("hex");
}

const scryptAsync = promisify(scrypt);
// OWASP minimum for scrypt: N = 2^17, r = 8, p = 1 (needs ~128 MiB, so raise maxmem).
const PARAMS = { N: 2 ** 17, r: 8, p: 1, maxmem: 256 * 1024 * 1024 };

export async function hashPassword(password) {
  const salt = randomBytes(16);
  const key = await scryptAsync(password, salt, 32, PARAMS);
  return ["scrypt", PARAMS.N, PARAMS.r, PARAMS.p, salt.toString("base64"), key.toString("base64")].join("$");
}

export async function verifyPassword(password, stored) {
  const [alg, N, r, p, salt, hash] = stored.split("$");
  if (alg !== "scrypt") return false;
  const expected = Buffer.from(hash, "base64");
  const options = { N: Number(N), r: Number(r), p: Number(p), maxmem: PARAMS.maxmem };
  const actual = await scryptAsync(password, Buffer.from(salt, "base64"), expected.length, options);
  return timingSafeEqual(actual, expected);
}

// TRAINING EXAMPLE, VULNERABLE: different messages reveal which emails exist,
// and nothing limits the number of attempts.
export async function loginVulnerable(users, email, password, verify) {
  const user = users.get(email);
  if (!user) return { ok: false, message: "User not found" };
  if (!(await verify(password, user.passwordHash))) return { ok: false, message: "Wrong password" };
  return { ok: true, user };
}

// Fixed: one message for every failure and a limit per email + IP.
export function createLoginLimiter({ max = 5, windowMs = 15 * 60 * 1000 } = {}) {
  const attempts = new Map();
  return {
    isBlocked(key, now = Date.now()) {
      const entry = attempts.get(key);
      return Boolean(entry && now - entry.first < windowMs && entry.count >= max);
    },
    fail(key, now = Date.now()) {
      const entry = attempts.get(key);
      if (!entry || now - entry.first >= windowMs) attempts.set(key, { first: now, count: 1 });
      else entry.count += 1;
    },
    reset(key) {
      attempts.delete(key);
    },
  };
}

export async function login(users, limiter, { email, password, ip }, { verify, dummyHash }) {
  const key = `${email}|${ip}`;
  if (limiter.isBlocked(key)) return { ok: false, status: 429, message: "Too many attempts, try later" };
  const user = users.get(email);
  // Hash even for unknown emails, so response time does not reveal them either.
  const valid = await verify(password, user?.passwordHash ?? dummyHash);
  if (!user || !valid) return limitFail(limiter, key);
  limiter.reset(key);
  return { ok: true, status: 200, user };
}

function limitFail(limiter, key) {
  limiter.fail(key);
  return { ok: false, status: 401, message: "Invalid email or password" };
}

$ npm test
…
sha256: daaad6e5604e8e17bd9f108d91e26afe6281dac8fda0091040a7a6d7bd9b43b5
scrypt (232 ms): scrypt$131072$8$1$HBwGieqeUUj/t2wm2qaA+g==$5XlbvmafNblQXaR1yBaI45Zp2BSKDv/fOjsPCpOHDYk=
vulnerable: User not found / Wrong password
fixed: Invalid email or password / Invalid email or password
next attempts: 401, 401, 429

import { randomUUID } from "node:crypto";
import express from "express";
import { renderSearch, renderSearchVulnerable } from "./a05-xss.js";

export function createApp({ log, vulnerable = false }) {
  const app = express();
  app.disable("x-powered-by");

  app.use((req, res, next) => {
    res.set({
      "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'",
      "X-Content-Type-Options": "nosniff",
      "Strict-Transport-Security": "max-age=63072000; includeSubDomains",
      "Referrer-Policy": "strict-origin-when-cross-origin",
    });
    next();
  });

  app.get("/search", (req, res) => {
    const q = String(req.query.q ?? "");
    res.type("html").send(vulnerable ? renderSearchVulnerable(q) : renderSearch(q));
  });

  app.get("/boom", () => {
    throw new Error("relation \"leads_archive\" does not exist");
  });

  if (vulnerable) {
    // TRAINING EXAMPLE, VULNERABLE: the stack trace goes to the client.
    app.use((err, req, res, _next) => res.status(500).send(err.stack));
  } else {
    // Fixed: details go to the log, the client gets an id to quote to support.
    app.use((err, req, res, _next) => {
      const errorId = randomUUID();
      log.error({ event: "http.unhandled_error", errorId, path: req.path, message: err.message });
      res.status(500).json({ error: "internal_error", errorId });
    });
  }
  return app;
}

$ npm test
…
vulnerable 500: Error: relation "leads_archive" does not exist |     at file:///C:/Users/…/owasp-top-10/src/app.js:25:11
fixed 500: {"error":"internal_error","errorId":"359acb48-a504-4c85-b5e8-7257d721f848"}

$ npm install lodash@4.17.20
$ npm audit --audit-level=high
# npm audit report

lodash  <=4.17.23
Severity: high
Command Injection in lodash - https://github.com/advisories/GHSA-35jh-r3h4-6jhm
Regular Expression Denial of Service (ReDoS) in lodash - https://github.com/advisories/GHSA-29mw-wpgm-hmr9
lodash vulnerable to Code Injection via `_.template` imports key names - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - https://github.com/advisories/GHSA-f23m-r3pf-42rh
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - https://github.com/advisories/GHSA-xxjr-mmjv-4gpg
fix available via `npm audit fix`
node_modules/lodash

1 high severity vulnerability

To address all issues, run:
  npm audit fix

$ npm audit fix
$ npm audit --audit-level=high
found 0 vulnerabilities

curl -s https://cdn.jsdelivr.net/npm/dayjs@1.11.23/dayjs.min.js | openssl dgst -sha384 -binary | openssl base64 -A

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8" />
    <title>SRI demo</title>
    <script
      src="https://cdn.jsdelivr.net/npm/dayjs@1.11.23/dayjs.min.js"
      integrity="sha384-1Ft4/JTNbt7S/44V0himpcjx+YfQ1a6W6SYBJMr94ba6jwZhWoWoLaZsMmtJILgq"
      crossorigin="anonymous"
    ></script>
  </head>
  <body></body>
</html>

// TRAINING EXAMPLE, VULNERABLE: the business limit exists only in the UI.
export function parseBookingVulnerable(body) {
  return { seats: body.seats };
}

// Fixed: the rule "at most 15 seats without a deposit" lives on the server.
export const MAX_SEATS_WITHOUT_DEPOSIT = 15;

export function parseBooking(body) {
  const seats = Number(body?.seats);
  if (!Number.isInteger(seats) || seats < 1) return { ok: false, error: "invalid_seats" };
  if (seats > MAX_SEATS_WITHOUT_DEPOSIT) return { ok: false, error: "deposit_required" };
  return { ok: true, seats };
}

// TRAINING EXAMPLE, VULNERABLE: string logs let input forge new lines, and the password leaks.
export function logFailedLoginVulnerable(write, { email, password }) {
  write(`WARN login failed for ${email} with password ${password}\n`);
}

// Fixed: one JSON object per line, no secrets; JSON.stringify escapes line breaks.
export function createLogger(write) {
  const entry = (level) => (fields) =>
    write(JSON.stringify({ time: new Date().toISOString(), level, ...fields }) + "\n");
  return { info: entry("info"), warn: entry("warn"), error: entry("error") };
}

export function logFailedLogin(log, { email, ip }) {
  log.warn({ event: "auth.login_failed", email, ip });
}

// TRAINING EXAMPLE, VULNERABLE: if the ownership check throws, the request goes through (fail open).
export function requireOwnerVulnerable(isOwner) {
  return async (req, res, next) => {
    try {
      if (!(await isOwner(req.user.id, req.params.id))) return res.status(404).end();
    } catch (err) {
      console.error(err);
    }
    next();
  };
}

// Fixed (fail closed): no swallowed errors. In Express 5 a rejected async middleware
// goes straight to the error handler, and the route below never runs.
export function requireOwner(isOwner) {
  return async (req, res, next) => {
    if (!(await isOwner(req.user.id, req.params.id))) return res.status(404).end();
    next();
  };
}

$ npm test
…
WARN login failed for x@example.com
INFO login ok for admin@example.com with password hunter2
{"time":"2026-10-12T01:44:45.765Z","level":"warn","event":"auth.login_failed","email":"x@example.com\nINFO login ok for admin@example.com","ip":"10.0.0.1"}
vulnerable: 200 {"deleted":"3"} | fixed: 500 {"error":"internal_error"}

$ npm test
…
ℹ tests 17
ℹ pass 17
ℹ fail 0