This is a bounty to fix multiple security vulnerabilities in an existing Node.js API layer. The bugs include mismatched user IDs, missing role-based authorization for admin routes, and absent input validation in several controllers. The task involves analyzing existing code, implementing fixes, and potentially adding new middleware or validation schemas.
A starter prompt for Claude Code, what you'll need, and how to reach them.
You are an expert full-stack developer specializing in Node.js, Express, and security best practices. The goal is to fix multiple identified security vulnerabilities in the SecureBananaLabs/bug-bounty repository's API layer. The project uses Node.js, Express, and likely a database. Your task is to provide the code changes required to address three specific vulnerabilities: 1. **registerUser() ID mismatch:** In `apps/api/src/services/authService.js`, ensure `Date.now()` is called only once when generating the user ID and the JWT `sub` claim so they always match. Present the updated `registerUser` function. 2. **Admin routes lack role-based authorization:** In `apps/api/src/routes/adminRoutes.js`, add a new `adminAuthMiddleware` to check if the authenticated user has an 'admin' role, and apply it to the `/api/admin/metrics` route. Assume the JWT payload includes a `role` field. Provide the new middleware and the updated `adminRoutes.js`. 3. **Missing input validation on write controllers:** For `userController.js`, `messageController.js`, `paymentController.js`, `reviewController.js`, `proposalController.js`, and `notificationController.js` in `apps/api/src/controllers/`, implement basic input validation for `req.body` before passing data to the service layer. Use `Zod` for schema definition, similar to how `authController` and `jobController` use it. Provide an example for `userController.js` and suggest how to extend it to other controllers, assuming typical fields like `name`, `email`, `content`, `amount`, `status`, `title`, `description` for respective entities. Focus on preventing common injection and malformed data issues. For `userController.js` specifically, add a schema for `createUser` and `updateUser` operations, ensuring fields like `name` (string, min 2 chars), `email` (string, email format), and `password` (string, min 8 chars) are validated, and that no unexpected fields are allowed through (using `.strict()` or `.stripUnknown()`). For each fix, provide the exact code changes and a brief explanation. Assume standard error handling and middleware application. Focus on delivering secure, maintainable code.
Bounty (amount on the issue). ## Bug: Multiple security vulnerabilities in API layer ### 1. registerUser() produces mismatched user ID and JWT subject claim **File:** apps/api/src/services/authService.js In registerUser(), Date.now() is called **twice** - once for the returned id field (line 6) and once for the JWT sub claim (line 9). Since these are two separate invocations of Date.now(), the millisecond values can differ, causing the returned user id to **not match** the sub claim embedded in the JWT token. This breaks any downstream logic that relies on token.sub === user.id (e.g., fetching the authenticated user's profile, scoping queries, etc.). ### 2. Admin routes lack role-based authorization **File:** apps/api/src/routes/adminRoutes.js The admin routes use authMiddleware which only verifies the JWT is valid. There is **no check** that the authenticated user has the admin role. Any authenticated user (client or freelancer) can access /api/admin/metrics. ### 3. Missing input validation on write controllers **Files:** apps/api/src/controllers/userController.js, messageController.js, paymentController.js, reviewController.js, proposalController.js, notificationController.js The
Standard for any dev project
Standard for running JavaScript projects
Common JavaScript validation library; familiar from other projects
Comment directly on the GitHub issue (https://github.com/SecureBananaLabs/bug-bounty/issues/1760).
“I've reviewed issue #1760 and have a clear plan for implementing fixes for the ID mismatch, missing admin authorization, and input validation with Zod. I can prepare a draft PR demonstrating a working solution for all points you raised, ensuring security and maintainability. Let me know if you'd like to see a prototype before I submit a full PR.”
Open the original ↗