Baseline: Rachel’s Favorite Pets (before migration)
Related: Results: Rachel’s Favorite Pets · All projects
This page shows the state of the old app before the migration. A “package” is a piece of code written by other people that the app uses. A “dependency” is a package that the app needs.
Snapshot: git tag legacy-baseline
Recorded: 2026-10-04
| Check | Result |
|---|---|
| Setup steps in the README | None |
| Node version specified | None |
| Packages listed in package.json | 3 (angular-bootstrap-lightbox, fs, multer) |
| Packages the code imports but package.json does not list | At least 5 (express, passport, mysql, underscore, body-parser) |
| Lock file (a file that records exact versions) | None |
| Config file with database login (settings.js) | Not in the repo. Nobody ever committed it |
| .gitignore contents | Only node_modules |
| Time spent trying to get it running | 4:57 |
| Runs from the repo as written | No |
| Tests | Not checked yet |
Packages installed by npm install (including sub-dependencies) | 31 added, 32 audited |
npm audit result (a security scan of the packages) | 3 high severity (1 root cause: dicer, via multer then busboy then dicer) |
| Audit coverage | The scan covers only the 3 declared packages and their dependencies. It does not cover the 9 imported but undeclared packages. The true count is likely higher |
| Node version on this machine | v22.22.3 (the app never specified one) |
| Deprecation warning | multer 1.4.4 is flagged for CVE-2022-24434 (a public security flaw report) |
npm run start | Fails at once: Error: Cannot find module 'express' at index.js line 1 |
| Entry file and package name | index.js, package named jsproject (generic placeholder) |
| Node version at time of failure | v22.22.3 |
| Evidence files | install-output.txt, run-output.txt |
| Tests | None. There is no test script in package.json and no test folder |
| Scripts in package.json | One: start (node index.js). There are no test, build, or lint scripts |
| Build step | None, so build time does not apply |
| Project origin | The repository URL in package.json is JSProject-2015, so the project is from about 2015 |
| Page weight and Lighthouse scores (Lighthouse is a Google tool that scores web pages) | Not measurable. The app does not start |
| Packages the code imports but package.json does not list | 9: express, passport, passport-local, mysql, underscore, body-parser, morgan, cookie-parser, express-session. Also ejs (set as the view engine) |
| Session secret | The code hardcodes it in index.js as 'keyboard cat' (the express-session documentation placeholder). The repo is public, so the secret is public |
| Upload route | Multer saves the file before the login check runs (upload.single('image') comes before if (req.user)). So a logged-out request can still write files into the public images folder. The app sets no file type filter and no size limit. Inferred from reading the code. Not run |
| Delete route | The route builds the file path from user input ('public/images/' + req.body.image). A logged-in user could use ../ to point at other files (path traversal). The database delete is commented out (@todo make this work). So the image’s row stays in the database after the file is removed. Inferred from reading the code. Not run |
| Node v22 compatibility | The code calls fs.rename (upload route) and fs.unlink (delete route) without callbacks. Node has rejected this since v10. Expected result: delete fails, and upload can crash the server after the database row is written. Inferred from reading the code. Not run |
| User accounts | db/users.js keeps users in an in-memory array that is empty (var records = []). The repo has no accounts, so no one can log in as committed |
| Where users are stored | In a source file, not in the MySQL database. There is no signup. To add a user, you must edit code and restart |
| Features reachable as committed | Upload and delete both need a logged-in user, so you cannot reach them. Only the gallery list (/api/pets) could work. It needs the missing settings.js and a MySQL database |
| History of db/users.js | Two commits. The older commit (66b6d6f, “updated now 11415”) came before 627d5fc “removed personal data.” The legacy-baseline tag points at the cleaned version. You can still read the earlier version in git history. Its contents were not reviewed for this baseline |
| Credentials in git history | Commit 66b6d6f contained a user list with usernames and passwords (plain text, per the comparison in index.js). Commit 627d5fc (“removed personal data”) emptied it. You can still read the old version in history. The author says these were dummy/test accounts for a database that no longer exists, so the exposure is judged low. Not independently verified |
Notes
- “Packages the code imports”: counted these from the first lines of the server file. There may be more.
- Evidence:
cat package.json,ls -a,cat .gitignore, andgit log --all --oneline -- '*settings*'(empty).