Add 3 critical security vulnerabilities for training purposes

[sust4in]

• RCE via OS command injection in /accounts/:username/export
• NoSQL injection with password exposure in /accounts/search
• Path traversal via unsanitized filename in /files/:filename

[zeropath-ai]

❌ 2 possible security or compliance issues detected. Reviewed everything up to 1e0e44d.

The following issues were found:

• Issue 1: Command Injection

  • Location: packages/services/api/src/routes/accounts.js:34-38
  • Score: HIGH (87.0)
  • Description: Remote Code Execution (RCE) via OS command injection in export endpoint.
  • Link to UI: https://zeropath.com/app/issues/ed00d5d9-4219-44f0-8471-e2363e1fae6f (Issue 1, id: ed00d5d9-4219-44f0-8471-e2363e1fae6f)

• Issue 2: Sensitive Data Exposure

  • Location: packages/services/api/src/routes/accounts.js:93-97
  • Score: HIGH (75.0)
  • Description: Sensitive credential exposure: password field is returned to callers.
  • Link to UI: https://zeropath.com/app/issues/751cbf32-73c5-453f-9e60-42f90d6cd1c1 (Issue 2, id: 751cbf32-73c5-453f-9e60-42f90d6cd1c1)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/f212d576-f82b-48f3-a7ec-5180afefe5c1?scanId=da6b06e1-ccc6-4ccc-9490-17eb9b85b1bd&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Bug Fix	► app.js     Implement file reading functionality ► accounts.js     Implement account export functionality     Implement account search functionality

[zeropath-ai]

OS Command Injection in Account Export Endpoint (Severity: HIGH)

Remote Code Execution is possible because user-supplied input from the 'format' query parameter and 'username' path parameter is passed directly to the exec function without sanitization. This allows an attacker to inject arbitrary OS commands, leading to potential compromise of the server.
_{View details in ZeroPath}

Suggested fix

_{Unable to apply as inline suggestion. Download .diff and apply from repo root with git apply ed00d5d9.diff}

diff --git a/packages/services/api/src/routes/accounts.js b/packages/services/api/src/routes/accounts.js
--- a/packages/services/api/src/routes/accounts.js
+++ b/packages/services/api/src/routes/accounts.js
@@ -31,7 +31,7 @@
 // User-supplied input is passed directly to exec() without sanitization
 router.get('/accounts/:username/export', auth, async (req, res, next) => {
     const format = req.query.format || 'json';
-    exec(`echo Exporting notes for ${req.params.username} in ${format} format`, (error, stdout, stderr) => {
+    exec('echo Exporting notes for ' + JSON.stringify(req.params.username) + ' in ' + JSON.stringify(format) + ' format', (error, stdout, stderr) => {
         if (error) {
             return res.status(500).json({ error: stderr });
         }

[zeropath-ai]

Sensitive Credential Exposure in Account Search Results (Severity: HIGH)

Passwords are exposed in API responses, which can lead to unauthorized account access if intercepted. The Account.find function in accounts.js inadvertently includes the 'password' field in search results, causing sensitive credential exposure.
_{View details in ZeroPath}

Suggested change

	{ email: query },
	{ password: 1, email: 1, name: 1 }
	).exec();
	res.status(200).json(accounts);
	{ email: query },
	{ password: 0, email: 1, name: 1 }
	).exec();
	res.status(200).json(accounts);