Skip to content

Update controller.js #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
haslam93 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update controller.js #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions api/controller.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,3 +42,10 @@ exports.calculate = function(req, res) {

res.json({ result: operation(req.query.operand1, req.query.operand2) });
};

//Make a change
if (!req.query.operand2 ||
!req.query.operand2.match(/^(-)?[0-9\.]+(e(-)?[0-9]+)?$/) ||
req.query.operand2.replace(/[-0-9e]/g, '').length > 1) {

Copilot AI Aug 13, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex pattern allows multiple decimal points (e.g., '1.2.3' would pass). The pattern should use a more restrictive regex like /^-?\d+(.\d+)?(e-?\d+)?$/i to properly validate decimal numbers.

Suggested change
req.query.operand2.replace(/[-0-9e]/g, '').length > 1) {
!req.query.operand2.match(/^-?\d+(\.\d+)?(e-?\d+)?$/i)) {

Copilot uses AI. Check for mistakes.

Copilot AI Aug 13, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This validation logic is complex and unclear. The replace operation checks for multiple decimal points but is difficult to understand. Consider using a clearer validation approach or adding a comment explaining the purpose.

Suggested change
req.query.operand2.replace(/[-0-9e]/g, '').length > 1) {
// Validate operand2: must be a valid floating-point number (optionally negative, with optional scientific notation)
if (!req.query.operand2 ||
!req.query.operand2.match(/^[-+]?(?:\d+\.?\d*|\.\d+)(?:e[-+]?\d+)?$/i)) {

Copilot uses AI. Check for mistakes.
throw new Error("Invalid operand2: " + req.query.operand2);

Copilot AI Aug 13, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The error message includes the raw user input (req.query.operand2), which could lead to information disclosure or log injection attacks. Consider using a generic error message without exposing the actual input value.

Suggested change
throw new Error("Invalid operand2: " + req.query.operand2);
throw new Error("Invalid operand2");

Copilot uses AI. Check for mistakes.
}

Copilot AI Aug 13, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The validation code is placed outside the function scope. This code should be moved inside the calculate function before the operation call to properly validate the input.

Suggested change
}

Copilot uses AI. Check for mistakes.