From fbf9f56230089c7695bd79083f1e086eb83479bf Mon Sep 17 00:00:00 2001
From: StackOverflowIsBetterThanAnyAI <michael.muenzenhofer@gmail.com>
Date: Fri, 30 Oct 2026 11:39:50 +0100
Subject: [PATCH] remove unintended log injection from CWE-352

updateEmail logged req.body.email unsanitized, which added a second
weakness (CWE-117) to a snippet meant to contain only CSRF.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CWE-352/main.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/CWE-352/main.js b/CWE-352/main.js
index 7c08ba1..ad36f65 100644
--- a/CWE-352/main.js
+++ b/CWE-352/main.js
@@ -5,8 +5,10 @@ const app = express()
 app.use(cookieParser())
 app.use(express.urlencoded({ extended: false }))
 
+const emails = new Map()
+
 const updateEmail = (sessionId, email) => {
-    console.log(`Session ${sessionId} changed email to ${email}`)
+    emails.set(sessionId, email)
 }
 
 app.post('/account/email', (req, res) => {