Sequelize Code Review

ISGroup SRL performed an automated Code Review (not a real Static Analysis, more a grep-on-steroid) of this NodeJS project in order to identify potential security vulnerabilities. We do not guarantee that all the findings are valid, and for sure there are plenty of false-positives and false-negatives (undetected issues) but it's free and your project could benefit from this security analisys. The following data is also available in JSON format!

Possible Security Issues

Issue	Description	Line	File
Server Side Injection(SSI) - new Function()	User controlled data in 'new Function()' can result in Server Side Injection (SSI) or Remote Code Execution (RCE).	342	test/supportShim.js
Server Side Injection(SSI) - setInterval()	User controlled data in 'setInterval()' can result in Server Side Injection (SSI) or Remote Code Execution (RCE).	91	test/integration/cls.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	52	test/integration/trigger.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	869	test/integration/instance.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	1054	test/integration/instance.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	1075	test/integration/instance.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	1076	test/integration/instance.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	1416	test/integration/instance.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	29	test/integration/hooks/validate.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	34	test/integration/hooks/validate.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	68	test/integration/hooks/validate.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	76	test/integration/hooks/validate.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	89	test/integration/hooks/validate.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	102	test/integration/hooks/validate.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	49	test/integration/hooks/count.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	255	test/integration/hooks/hooks.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	76	test/integration/hooks/find.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	86	test/integration/hooks/find.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	96	test/integration/hooks/find.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	121	test/integration/hooks/bulkOperation.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	154	test/integration/hooks/bulkOperation.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	256	test/integration/hooks/bulkOperation.test.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	308	test/integration/hooks/bulkOperation.test.js
Key Hardcoded	A hardcoded key in plain text was identified.	95	test/unit/associations/has-many.test.js
Key Hardcoded	A hardcoded key in plain text was identified.	100	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	137	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	154	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	186	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	242	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	268	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	291	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	314	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	330	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	346	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	386	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	408	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	427	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	470	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	485	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	503	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	522	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	533	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	548	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	628	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	661	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	680	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	699	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	759	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	778	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	798	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	883	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	906	lib/data-types.js
Key Hardcoded	A hardcoded key in plain text was identified.	618	lib/model.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	1222	lib/model.js
Username Hardcoded	A hardcoded username in plain text was identified. Store it properly in a config file.	1223	lib/model.js
Key Hardcoded	A hardcoded key in plain text was identified.	1962	lib/dialects/abstract/query-generator.js
Key Hardcoded	A hardcoded key in plain text was identified.	2038	lib/dialects/abstract/query-generator.js
Key Hardcoded	A hardcoded key in plain text was identified.	76	lib/dialects/sqlite/connection-manager.js

Missing Security Features

Issue	Description
Missing Security Header - X-Frame-Options (XFO)	X-Frame-Options (XFO) header provides protection against Clickjacking attacks.
Missing Security Header - Content-Security-Policy (CSP)	Content Security Policy (CSP), a mechanism web applications can use to mitigate a broad class of content injection vulnerabilities, such as cross-site scripting (XSS). CSP Header was not found.
Missing Security Header - Strict-Transport-Security (HSTS)	Strict-Transport-Security (HSTS) header enforces secure (HTTP over SSL/TLS) connections to the server.
Missing 'httpOnly' in Cookie	JavaScript can access Cookies if they are not marked httpOnly.
Infromation Disclosure - X-Powered-By	Remove the X-Powered-By header to prevent information gathering.
Missing Security Header - X-Content-Type-Options	X-Content-Type-Options header prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type.
Missing Security Header - X-Download-Options: noopen	X-Download-Options header set to noopen prevents IE users from directly opening and executing downloads in your site's context.
Missing Security Header - X-XSS-Protection:1	X-XSS-Protection header set to 1 enables the Cross-site scripting (XSS) filter built into most recent web browsers.
Missing Security Header - Public-Key-Pins (HPKP)	Public-Key-Pins (HPKP) ensures that certificate is Pinned.

Node.Security

Security Audit of Sequelize