Node.js Risk Assessment & Management 3

Question 1

A Node.js application uses eval() to execute user-provided strings for a calculator feature. What is the main security risk?

Accepted Answer

Arbitrary code execution in the server process

Answer

eval() executes any JavaScript in the current process context, allowing an attacker to read environment variables, access the filesystem, or spawn processes.

Question 2

What is the risk of storing session tokens in URL query parameters in a Node.js web application?

Accepted Answer

Tokens are logged in server access logs and browser history, enabling theft

Answer

URLs appear in server logs, Referer headers, and browser history, exposing session tokens to unintended parties.

Question 3

Which npm audit severity level should block a CI/CD pipeline deployment by default?

Accepted Answer

critical

Answer

Critical vulnerabilities have known exploits with high impact; blocking on critical ensures no actively dangerous dependency reaches production.

Question 4

A Node.js service receives a JWT and verifies it using jwt.verify(token, secret). What risk does omitting the algorithms option introduce?

Accepted Answer

Algorithm confusion attacks, including the 'none' algorithm bypass

Answer

Without restricting algorithms, an attacker can forge tokens signed with 'none' or switch from RS256 to HS256 using the public key as the HMAC secret.

Question 5

What risk is introduced when a Node.js app reads a file path constructed from user input without path normalization?

Accepted Answer

Path traversal allowing access to files outside the intended directory

Answer

Sequences like '../../../etc/passwd' let attackers escape the intended directory and read sensitive system files.

Node.js Practice Test

Node.js Practice Test

Node.js Risk Assessment & Management 3