From 7ea55f4b2389378c890d6e6fcad8c7245a58c763 Mon Sep 17 00:00:00 2001 From: anupamme Date: Thu, 20 Aug 2026 22:27:26 +0000 Subject: [PATCH 1/2] fix: javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage security vulnerability Automated security fix generated by OrbisAI Security --- appengine/building-an-app/update/package.json | 2 ++ appengine/building-an-app/update/server.js | 8 ++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/appengine/building-an-app/update/package.json b/appengine/building-an-app/update/package.json index c320fc64744..755e7ca7ded 100644 --- a/appengine/building-an-app/update/package.json +++ b/appengine/building-an-app/update/package.json @@ -19,6 +19,8 @@ "author": "Google Inc.", "license": "Apache-2.0", "dependencies": { + "cookie-parser": "^1.4.6", + "csurf": "^1.11.0", "express": "^4.18.2" }, "devDependencies": { diff --git a/appengine/building-an-app/update/server.js b/appengine/building-an-app/update/server.js index f453e82cd9c..0d2495d6a90 100755 --- a/appengine/building-an-app/update/server.js +++ b/appengine/building-an-app/update/server.js @@ -16,13 +16,16 @@ // [START gae_update_web_server_app] const express = require('express'); -const path = require('path'); +const cookieParser = require('cookie-parser'); +const csrf = require('csurf'); const app = express(); // [START gae_enable_parser] // This middleware is available in Express v4.16.0 onwards +app.use(cookieParser()); app.use(express.urlencoded({extended: true})); +app.use(csrf({cookie: true})); // [END gae_enable_parser] app.get('/', (req, res) => { @@ -31,7 +34,8 @@ app.get('/', (req, res) => { // [START gae_add_display_form] app.get('/submit', (req, res) => { - res.sendFile(path.join(__dirname, '/views/form.html')); + const token = req.csrfToken(); + res.send(`My App Engine App

Create a new post

`); }); // [END gae_add_display_form] From 16ffe80e83a92da2bc0c426217254f26de047e79 Mon Sep 17 00:00:00 2001 From: anupamme Date: Fri, 21 Aug 2026 20:29:18 +0000 Subject: [PATCH 2/2] Address review feedback (2 comments) --- appengine/building-an-app/update/server.js | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) mode change 100755 => 100644 appengine/building-an-app/update/server.js diff --git a/appengine/building-an-app/update/server.js b/appengine/building-an-app/update/server.js old mode 100755 new mode 100644 index 0d2495d6a90..90c8333915d --- a/appengine/building-an-app/update/server.js +++ b/appengine/building-an-app/update/server.js @@ -18,6 +18,8 @@ const express = require('express'); const cookieParser = require('cookie-parser'); const csrf = require('csurf'); +const fs = require('fs').promises; +const path = require('path'); const app = express(); @@ -33,9 +35,18 @@ app.get('/', (req, res) => { }); // [START gae_add_display_form] -app.get('/submit', (req, res) => { - const token = req.csrfToken(); - res.send(`My App Engine App

Create a new post

`); +app.get('/submit', async (req, res, next) => { + try { + const token = req.csrfToken(); + const template = await fs.readFile(path.join(__dirname, '/views/form.html'), 'utf-8'); + const html = template.replace( + '
', + `` + ); + res.send(html); + } catch (err) { + next(err); + } }); // [END gae_add_display_form]