Baseline: Rachel’s Favorite Pets (before migration)
Snapshot: git tag legacy-baseline
Recorded: 2026-10-04
| Check | Result |
|---|---|
| Setup steps in the README | None |
| Node version specified | None |
| Packages listed in package.json | 3 (angular-bootstrap-lightbox, fs, multer) |
| Packages the code imports but package.json does not list | At least 5 (express, passport, mysql, underscore, body-parser) |
| Lock file (exact versions) | None |
| Config file with database login (settings.js) | Not in the repo, never committed |
| .gitignore contents | Only node_modules |
| Time spent trying to get it running | 4:57 |
| Runs from the repo as written | No |
| Tests | Not checked yet |
Packages installed by npm install (including sub-dependencies) | 31 added, 32 audited |
npm audit result | 3 high severity (1 root cause: dicer, via multer then busboy then dicer) |
| Audit coverage | Only the 3 declared packages and their dependencies. Excludes the 9 imported but undeclared packages, so the true count is likely higher |
| Node version on this machine | v22.22.3 (the app never specified one) |
| Deprecation warning | multer 1.4.4 flagged for CVE-2022-24434 |
npm run start | Fails immediately: Error: Cannot find module 'express' at index.js line 1 |
| Entry file and package name | index.js, package named jsproject (generic placeholder) |
| Node version at time of failure | v22.22.3 |
| Evidence files | install-output.txt, run-output.txt |
| Tests | None. No test script in package.json and no test folder |
| Scripts in package.json | One: start (node index.js). No test, build, or lint scripts |
| Build step | None, so build time is not applicable |
| Project origin | Repository URL in package.json is JSProject-2015, so about 2015 |
| Page weight and Lighthouse scores | Not measurable. The app does not start |
| Packages the code imports but package.json does not list | 9: express, passport, passport-local, mysql, underscore, body-parser, morgan, cookie-parser, express-session. Also ejs (set as the view engine) |
| Session secret | Hardcoded in index.js as 'keyboard cat' (the express-session documentation placeholder). The repo is public, so the secret is public |
| Upload route | Multer saves the file before the login check runs (upload.single('image') comes before if (req.user)), so logged-out requests can still write files into the public images folder. No file type filter or size limit is configured. Inferred from reading the code, not run |
| Delete route | Builds the file path from user input ('public/images/' + req.body.image), so a logged-in user could use ../ to point at other files (path traversal). The database delete is commented out (@todo make this work), so the image’s row stays in the database after the file is removed. Inferred from reading the code, not run |
| Node v22 compatibility | fs.rename (upload route) and fs.unlink (delete route) are called without callbacks, which Node has rejected since v10. Expected: delete fails, and upload can crash the server after the database row is written. Inferred from reading the code, not run |
| User accounts | db/users.js keeps users in an in-memory array that is empty (var records = []). No accounts exist in the repo, so no one can log in as committed |
| Where users are stored | In a source file, not the MySQL database. No signup, so adding a user means editing code and restarting |
| Features reachable as committed | Upload and delete both need a logged-in user, so neither can be reached. Only the gallery list (/api/pets) could work, and it needs the missing settings.js and a MySQL database |
| History of db/users.js | Two commits. The older (66b6d6f, “updated now 11415”) was followed by 627d5fc “removed personal data.” The legacy-baseline tag points at the cleaned version, but the earlier version is still readable in git history. Contents not reviewed for this baseline |
| Credentials in git history | Commit 66b6d6f contained a user list with usernames and passwords (plain text, per the comparison in index.js). Commit 627d5fc (“removed personal data”) emptied it, but the old version is still readable in history. Per the author these were dummy/test accounts for a database that no longer exists, so exposure is judged low. Not independently verified |
Notes
- “Packages the code imports”: counted from the first lines of the server file. There may be more.
- Evidence:
cat package.json,ls -a,cat .gitignore, andgit log --all --oneline -- '*settings*'(empty).