[StackOverflowIsBetterThanAnyAI]

What changed

updateEmail in CWE-352/main.js no longer logs req.body.email. It now stores the email in a Map instead.

Why

Each snippet should contain exactly one intended weakness. The console.log added an unintended second weakness (CWE-117, log injection), which CodeQL reported as js/log-injection and which would skew the benchmark result.

Notes for reviewers

• The CSRF weakness itself is unchanged: the state-changing POST route still relies on cookies without a CSRF token.
• After merging, CodeQL should close the js/log-injection alert in CWE-352.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6f2bc882-85c0-4786-8cde-1ea8abb39aa6

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}