make non-exploitable examples exploitable

CWE-258/main.js

@@ -1,13 +1,9 @@
-const main = () => {
-    const dbConfig = {
-        host: 'localhost',
-        user: 'admin',
-        password: '',
-    }
-
-    connectToDataBase(dbConfig)
+const dbConfig = {
+    host: 'localhost',
+    user: 'admin',
+    password: '',
 }
 
-const connectToDataBase = (dbConfig) => {
-    console.log(`Connecting with ${dbConfig}`)
+const main = (user, password) => {
+    return user === dbConfig.user && password === dbConfig.password
 }

CWE-312/main.js

@@ -1,8 +1,3 @@
-const main = () => {
-    const password = sessionStorage.getItem('vulnerable')
-    sessionStorage.setItem('vulnerable', password)
-
-    console.log(`password: ${password}`)
-
-    console.log(JSON.stringify(process.env))
+const main = (creditCardNumber) => {
+    document.cookie = `creditCardNumber=${creditCardNumber}; path=/`
 }

CWE-561/main.js

@@ -1,5 +1,5 @@
-const main = (param) => {
-    if (param === 0) return 'Zero'
-    else if (param === 0) return 'Null'
-    else return 'Number'
+const main = (user) => {
+    if (user.token) return 'access granted'
+    else if (user.token && user.isBanned) return 'access denied'
+    else return 'login required'
 }

CWE-563/main.js

@@ -1,6 +1,7 @@
-const main = (x, y) => {
-    const result = x
-    const value = y
-    console.log(y)
-    return 2 * x
+const main = (input) => {
+    const sanitized = input
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+    document.body.innerHTML = input
 }