Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,3 +29,12 @@ This repository demonstrates sample issues in JavaScript code raised by DeepSour
### Documentation

[https://deepsource.io/docs/analyzer/javascript.html](https://deepsource.io/docs/analyzer/javascript.html)

### Example: loose equality (illustrative only)

```js
var flag = true;
if (flag == true) {
console.log('flag is set');
}
```
9 changes: 9 additions & 0 deletions index.js
Original file line number Diff line number Diff line change
Expand Up @@ -83,3 +83,12 @@ function isMatched(str){
const matches = str.match(/hasTheMagic/)[0] ? process(str) : null;
return matches
}

function legacyLogger(value){
var count = 0;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`var` usage risks re-declaration and unwanted global scope


The use of var for declaring count applies function or global scope to the variable, which can lead to bugs from accidental re-declarations or overwriting in nested blocks. This can cause unexpected behaviors where count is changed unintentionally.

Replace var with let if count will be reassigned, or const if it remains constant. This change uses block scope to limit the variable's lifetime and prevent conflicts with other code blocks.

console.log(`legacy value: ${value}`);
if(count == value){

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`==` operator allows type coercion leading to bugs


The == operator compares values with type coercion, which can lead to unexpected true comparisons when operands have different types. This can cause subtle bugs, especially in conditional expressions like if(count == value).

Replace == with === to enforce type-safe comparison that only returns true for equal values without type conversion, improving code reliability and predictability.

debugger;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`debugger` can pause runtime under attached inspector


legacyLogger contains a debugger statement that can stop execution whenever the branch is reached with an attached inspector. This creates reliability risk and may expose paused process state during incident debugging.

Remove debugger from committed runtime code and rely on structured logging or conditional debug flags

}
return count
}
9 changes: 9 additions & 0 deletions legacy-config.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
const path = require('path');

const AWS_ACCESS_KEY = 'AKIAIOSFODNN7EXAMPLE';

function resolveConfigPath(name) {
return path.join('config', name);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`path.join('config', name)` allows traversal outside intended directory


resolveConfigPath builds a filesystem path from unsanitized name. If any caller passes user-controlled values, .. segments can escape config and expose or overwrite unintended files.
Add canonicalization and prefix validation: const p = path.resolve('config', name) then reject when !p.startsWith(path.resolve('config') + path.sep)

}

module.exports = { resolveConfigPath, AWS_ACCESS_KEY };
12 changes: 12 additions & 0 deletions server.js
Original file line number Diff line number Diff line change
Expand Up @@ -23,3 +23,15 @@ request('http://www.google.com', function (error, response, body) {
app.get('/', function (req, res) {
res.send('hello')
});
Comment on lines 23 to 25

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unexpected function expression


It is recommended to use arrow functions as callbacks.


app.get('/health', function (req, res) {
debugger;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`debugger` statement can pause live request handling


debugger in a request path can suspend the process when debugging is enabled. A single /health call may stall concurrent traffic and expose runtime internals to attached debuggers.

Remove the debugger statement from this route before deployment.


request('http://internal.example.com/health', function (error, response, body) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`request()` without `timeout` can exhaust worker capacity


The internal probe uses request with default timeout behavior. If upstream stalls, each /health invocation can remain pending and consume resources under repeated checks.

Use request({ url: 'http://internal.example.com/health', timeout: 2000 }, ...) and treat timeout errors as degraded.

if (response.statusCode == 200) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use of `==` risks unexpected type coercion


Using == in response.statusCode == 200 allows JavaScript to convert types implicitly, potentially causing false positives or negatives in conditions. This can result in logic errors or security issues if values are coerced unpredictably.

Replace == with === for strict equality checks, ensuring predictable and type-safe comparisons in all cases.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`response.statusCode` dereference can crash on request failures


request callback logic reads response.statusCode without verifying response exists. Transient DNS or connection failures can raise runtime exceptions and make the health endpoint unstable.

Add a guard before the status check: handle missing response and return 503 with 'degraded' early.

res.send('ok');
} else {
res.send('degraded');
}
});
});