小程序渗透测试双11活动

// 示例代码：安全的查询方式
const userId = req.body.userId;
const user = await db.query('SELECT * FROM users WHERE id = ?', [userId]);

// 示例代码：防止XSS攻击
const escapeHtml = (str) => {
  return str.replace(/&/g, '&')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;')
            .replace(/"/g, '&quot;')
            .replace(/'/g, '&#039;');
};

const userInput = req.body.input;
const safeInput = escapeHtml(userInput);

// 示例代码：基于角色的访问控制
const checkPermission = (userRole, requiredRole) => {
  const roles = { admin: 3, manager: 2, user: 1 };
  return roles[userRole] >= roles[requiredRole];
};

if (checkPermission(currentUser.role, 'manager')) {
  // 允许访问
} else {
  // 拒绝访问
}

// 示例代码：安全的会话管理
const session = require('express-session');
app.use(session({
  secret: 'your-secret-key',
  resave: false,
  saveUninitialized: true,
  cookie: { secure: true, maxAge: 3600000 } // HTTPS only, 1 hour timeout
}));