OWASP Juice Shop v20.2.0

31    models.sequelize.query(`SELECT * FROM Users WHERE email = '${req.body.email || ''}' AND password = '${security.hash(req.body.password || '')}' AND deletedAt IS NULL`, { model: UserModel, plain: true })

22    models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`)

260  app.use('/infrastructure', serveIndexMiddleware, serveIndex('infrastructure', { icons: true, view: 'details', filter: (filename) => filename !== 'README.md' }))

278  app.use('/ftp', serveIndexMiddleware, serveIndex('ftp', { icons: true }))

282  app.use('/.well-known', serveIndexMiddleware, serveIndex('.well-known', { icons: true, view: 'details' }))

286  app.use('/encryptionkeys', serveIndexMiddleware, serveIndex('encryptionkeys', { icons: true, view: 'details' }))

290  app.use('/support/logs', serveIndexMiddleware, serveIndex('logs', { icons: true, view: 'details' }))

41export const hash = (data: string) => crypto.createHash('md5').update(data).digest('hex')

67      password: {
68        type: DataTypes.STRING,
69        set (clearTextPassword: string) {
70          this.setDataValue('password', security.hash(clearTextPassword))
71        }
72      },

31    models.sequelize.query(`SELECT * FROM Users WHERE email = '${req.body.email || ''}' AND password = '${security.hash(req.body.password || '')}' AND deletedAt IS NULL`, { model: UserModel, plain: true })

28  ngOnInit (): void {
29    this.userService.oauthLogin(this.parseRedirectUrlParams().access_token).subscribe({
30      next: (profile: any) => {
31        const password = btoa(profile.email.split('').reverse().join(''))
32        this.userService.save({ email: profile.email, password, passwordRepeat: password }).subscribe({
33          next: () => {
34            this.login(profile)
35          },
36          error: () => { this.login(profile) }
37        })
38      },
39      error: (error) => {
40        this.invalidateSession(error)
41        this.ngZone.run(async () => await this.router.navigate(['/login']))
42      }
43    })
44  }
45
46  login (profile: any) {
47    this.userService.login({ email: profile.email, password: btoa(profile.email.split('').reverse().join('')), oauth: true }).subscribe({
48      next: (authentication) => {
49        const expires = new Date()
50        expires.setHours(expires.getHours() + 8)
51        this.cookieService.put('token', authentication.token, { expires })
52        localStorage.setItem('token', authentication.token)

13 more lines in the HTML report

18  function afterLogin (user: User, res: Response, next: NextFunction) {
19    BasketModel.findOrCreate({ where: { UserId: user.id } })
20      .then(([basket]: [BasketModel, boolean]) => {
21        const authenticatedUser = { data: user, bid: basket.id } // keep track of original basket
22        const token = security.authorize(authenticatedUser)
23        security.authenticatedUsers.put(token, authenticatedUser)
24        res.json({ authentication: { token, bid: basket.id, umail: user.email } })

41    const token = security.authorize(plainUser)
42    // @ts-expect-error FIXME set new property for original basket
43    plainUser.bid = basket.id // keep track of original basket for challenge solution check
44    security.authenticatedUsers.put(token, plainUser)

184export const updateAuthenticatedUsers = () => (req: Request, res: Response, next: NextFunction) => {
185  const token = req.cookies.token || utils.jwtFrom(req)
186  if (token && authenticatedUsers.get(token) === undefined) {
187    jwt.verify(token, publicKey, (err: Error | null, decoded: any) => {
188      if (err === null && decoded?.data !== undefined) {
189        authenticatedUsers.put(token, decoded)
190        res.cookie('token', token)
191      }
192    })
193  }
194  next()
195}

100      next: (authentication: any) => {
101        const redirectUrl = this.route.snapshot.queryParamMap.get('redirectUrl') ?? '/search'
102        localStorage.setItem('token', authentication.token)
103        const expires = new Date()
104        expires.setHours(expires.getHours() + 8)
105        this.cookieService.put('token', authentication.token, { expires })
106        sessionStorage.setItem('bid', authentication.bid)

241  logout () {
242    this.userService.saveLastLoginIp().subscribe({ next: () => { this.noop() }, error: (err) => { console.log(err) } })
243    localStorage.removeItem('token')
244    this.cookieService.remove('token')
245    sessionStorage.removeItem('bid')
246    sessionStorage.removeItem('itemTotal')
247    sessionStorage.removeItem('guestBasket')
248    this.userService.isLoggedIn.next(false)
249    this.ngZone.run(async () => await this.router.navigate(['/']))
250  }

13  return async ({ query, headers, connection }: Request, res: Response, next: NextFunction) => {
14    const currentPassword = query.current as string
15    const newPassword = query.new as string
16    const newPasswordInString = newPassword?.toString()
17    const repeatPassword = query.repeat
18
19    if (!newPassword || newPassword === 'undefined') {
20      res.status(401).send(res.__('Password cannot be empty.'))
21      return
22    } else if (newPassword !== repeatPassword) {
23      res.status(401).send(res.__('New and repeated password do not match.'))
24      return
25    }
26
27    const token = headers.authorization ? headers.authorization.substr('Bearer='.length) : null
28    if (token === null) {
29      next(new Error('Blocked illegal activity by ' + connection.remoteAddress))
30      return
31    }
32
33    const loggedInUser = security.authenticatedUsers.get(token)
34    if (!loggedInUser) {
35      next(new Error('Blocked illegal activity by ' + connection.remoteAddress))
36      return
37    }
38
39    if (currentPassword && security.hash(currentPassword) !== loggedInUser.data.password) {
40      res.status(401).send(res.__('Current password is not correct.'))
41      return
42    }

18 more lines in the HTML report

591  app.get('/rest/user/change-password', utils.asyncHandler(changePassword()))

345  app.use(morgan('combined', { stream: accessLogStream }))

34    try {
35      const data = await SecurityAnswerModel.findOne({
36        include: [{
37          model: UserModel,
38          where: { email }
39        }]
40      })
41      if ((data != null) && security.hmac(answer) === data.answer) {
42        const user = await UserModel.findByPk(data.UserId)
43        if (user) {
44          const updatedUser = await user.update({ password: newPassword })
45          res.json({ user: updatedUser })
46        }
47      } else {
48        res.status(401).send(res.__('Wrong answer to security question.'))
49      }

4 more lines in the HTML report

12  return async ({ query }: Request, res: Response, next: NextFunction) => {
13    const email = query.email
14    try {
15      const answer = await SecurityAnswerModel.findOne({
16        include: [{
17          model: UserModel,
18          where: { email: email?.toString() }
19        }]
20      })
21      if (answer != null) {
22        const question = await SecurityQuestionModel.findByPk(answer.SecurityQuestionId)
23        res.json({ question })
24      } else {
25        res.json({})
26      }

3 more lines in the HTML report

348  app.enable('trust proxy')
349  app.use('/rest/user/reset-password', rateLimit({
350    windowMs: 5 * 60 * 1000,
351    max: 100,
352    keyGenerator ({ headers, ip }: { headers: any, ip: any }) { return headers['X-Forwarded-For'] ?? ip }
353  }))

455  app.post('/rest/2fa/verify',
456    rateLimit({ windowMs: 5 * 60 * 1000, max: 100, validate: false }),
457    utils.asyncHandler(twoFactorAuth.verify)
458  )

590  app.post('/rest/user/login', login())

16  return async (req: Request, res: Response, next: NextFunction) => {
17    try {
18      const id = req.params.id
19      const basket = await BasketModel.findOne({ where: { id }, include: [{ model: ProductModel, paranoid: false, as: 'Products' }] })
20      /* jshint eqeqeq:false */
21      if (((basket?.Products) != null) && basket.Products.length > 0) {
22        for (let i = 0; i < basket.Products.length; i++) {
23          basket.Products[i].name = req.__(basket.Products[i].name)
24        }
25      }
26
27      res.json(utils.queryResultToJson(basket))

33  return (req: Request, res: Response, next: NextFunction) => {
34    const id = req.params.id
35    BasketModel.findOne({ where: { id }, include: [{ model: ProductModel, paranoid: false, as: 'Products' }] })
36      .then(async (basket: BasketModel | null) => {
37        if (basket != null) {
38          const customer = security.authenticatedUsers.from(req)
39          const email = customer ? customer.data ? customer.data.email : '' : ''

11  return async ({ params }: Request, res: Response, next: NextFunction) => {
12    try {
13      const id = params.id
14      let coupon: string | undefined | null = params.coupon ? decodeURIComponent(params.coupon) : undefined
15      const discount = security.discountFromCoupon(coupon)
16      coupon = discount ? coupon : null
17
18      const basket = await BasketModel.findByPk(id)
19      if (!basket) {
20        next(new Error(`Basket with id=${id} does not exist.`))
21        return
22      }
23
24      await basket.update({ coupon: coupon?.toString() })

2 more lines in the HTML report

21    const result = utils.parseJsonCustom((req as RequestWithRawBody).rawBody)
22    const productIds = []
23    const basketIds = []
24    const quantities = []
25
26    for (let i = 0; i < result.length; i++) {
27      if (result[i].key === 'ProductId') {
28        productIds.push(result[i].value)
29      } else if (result[i].key === 'BasketId') {
30        basketIds.push(result[i].value)
31      } else if (result[i].key === 'quantity') {
32        quantities.push(result[i].value)
33      }
34    }
35
36    const user = security.authenticatedUsers.from(req)
37    if (user && basketIds[0] && basketIds[0] !== 'undefined' && Number(user.bid) != Number(basketIds[0])) { // eslint-disable-line eqeqeq
38      res.status(401).send('{\'error\' : \'Invalid BasketId\'}')
39    } else {
40      const basketItem = {
41        ProductId: productIds[productIds.length - 1],
42        BasketId: basketIds[basketIds.length - 1],
43        quantity: quantities[quantities.length - 1]
44      }
45
46      const basketItemInstance = BasketItemModel.build(basketItem)

14 more lines in the HTML report

359  app.use('/rest/basket', security.isAuthorized(), security.appendUserId())
360  /* BasketItems: API only accessible for authenticated users */
361  app.use('/api/BasketItems', security.isAuthorized())
362  app.use('/api/BasketItems/:id', security.isAuthorized())

21export function addWalletBalance () {
22  return async (req: Request, res: Response, next: NextFunction) => {
23    const cardId = req.body.paymentId
24    const card = cardId ? await CardModel.findOne({ where: { id: cardId, UserId: req.body.UserId } }) : null
25    if (card != null) {
26      try {
27        await WalletModel.increment({ balance: req.body.balance }, { where: { UserId: req.body.UserId } })
28        res.status(200).json({ status: 'success', data: req.body.balance })
29      } catch {
30        res.status(404).json({ status: 'error' })
31      }
32    } else {
33      res.status(402).json({ status: 'error', message: 'Payment not accepted.' })
34    }
35  }

3 more lines in the HTML report

39      quantity: DataTypes.INTEGER

92              const itemTotal = itemPrice * BasketItem.quantity

144          if (req.body.UserId) {
145            if (req.body.orderDetails && req.body.orderDetails.paymentId === 'wallet') {
146              const wallet = await WalletModel.findOne({ where: { UserId: req.body.UserId } })
147              if ((wallet != null) && wallet.balance >= totalPrice) {
148                await WalletModel.decrement({ balance: totalPrice }, { where: { UserId: req.body.UserId } })
149              } else {
150                next(new Error('Insufficient wallet balance.'))
151                return
152              }
153            }
154            try {
155              await WalletModel.increment({ balance: totalPoints }, { where: { UserId: req.body.UserId } })

17  return ({ body }: Request, res: Response, next: NextFunction) => {
18    if (utils.isChallengeEnabled(challenges.ch143cb02f) || utils.isChallengeEnabled(challenges.ch0ca8dfb9)) {
19      const orderLinesData = body.orderLinesData || ''
20      try {
21        const sandbox = { safeEval, orderLinesData }
22        vm.createContext(sandbox)
23        vm.runInContext('safeEval(orderLinesData)', sandbox, { timeout: 2000 })
24        res.json({ cid: body.cid, orderNo: uniqueOrderNumber(), paymentDue: dateTwoWeeksFromNow() })
25      } catch (err) {
26        if (utils.getErrorMessage(err).match(/Script execution timed out.*/) != null) {
27          res.status(503)
28          next(new Error('Sorry, we are temporarily not available! Please try again later.'))
29        } else {
30          next(err)
31        }
32      }

4 more lines in the HTML report

13  return (req: Request, res: Response) => {
14    // Truncate id to avoid unintentional RCE
15    const id = !utils.isChallengeEnabled(challenges.ch46bea641) ? String(req.params.id).replace(/[^\w-]+/g, '') : utils.trunc(req.params.id, 60)
16
17    db.ordersCollection.find({ $where: `this.orderId === '${id}'` }).then((order: any) => {
18      const result = utils.queryResultToJson(order)
19      if (result.data[0] === undefined) {
20        result.data[0] = { orderId: id }
21      }
22      res.json(result)

17global.sleep = (time: number) => {
18  // Ensure that users don't accidentally dos their servers for too long
19  if (time > 2000) {
20    time = 2000
21  }
22  const stop = new Date().getTime()
23  while (new Date().getTime() < stop + time) {
24    ;
25  }
26}
27
28export function showProductReviews () {
29  return (req: Request, res: Response, next: NextFunction) => {
30    // Truncate id to avoid unintentional RCE
31    const id = !utils.isChallengeEnabled(challenges.ch56e73652) ? Number(req.params.id) : utils.trunc(req.params.id, 40)
32
33    // Measure how long the query takes, to check if there was a nosql dos attack
34    const t0 = new Date().getTime()
35
36    db.reviewsCollection.find({ $where: 'this.product == ' + id }).then((reviews: Review[]) => {

8 more lines in the HTML report

15    const user = security.authenticatedUsers.from(req)
16    db.reviewsCollection.update(
17      { _id: req.body.id },
18      { $set: { message: req.body.message } },
19      { multi: true }
20    ).then(

16    const user = security.authenticatedUsers.from(req)
17
18    try {
19      await reviewsCollection.insert({
20        product: req.params.id,
21        message: req.body.message,
22        author: req.body.author,
23        likesCount: 0,
24        likedBy: []
25      })

30      const likedBy = review.likedBy
31      if (likedBy.includes(user.data.email)) {
32        return res.status(403).json({ error: 'Not allowed' })
33      }
34
35      await db.reviewsCollection.update(
36        { _id: id },
37        { $inc: { likesCount: 1 } }
38      )
39
40      // Artificial wait for timing attack challenge
41      await sleep(150)
42      try {
43        const updatedReview: Review = await db.reviewsCollection.findOne({ _id: id })
44        const updatedLikedBy = updatedReview.likedBy
45        updatedLikedBy.push(user.data.email)
46
47        const count = updatedLikedBy.filter(email => email === user.data.email).length
48
49        const result = await db.reviewsCollection.update(
50          { _id: id },
51          { $set: { likedBy: updatedLikedBy } }
52        )

11 more lines in the HTML report

18    if (req.body.imageUrl !== undefined) {
19      const url = req.body.imageUrl
20      if (url.match(/(.)*solve\/challenges\/server-side(.)*/) !== null) req.app.locals.abused_ssrf_bug = true
21      const loggedInUser = security.authenticatedUsers.get(req.cookies.token)
22      if (loggedInUser) {
23        try {
24          const response = await fetch(url)
25          if (!response.ok || !response.body) {
26            throw new Error('url returned a non-OK status code or an empty body')
27          }
28          const ext = ['jpg', 'jpeg', 'png', 'svg', 'gif'].includes(url.split('.').slice(-1)[0].toLowerCase()) ? url.split('.').slice(-1)[0].toLowerCase() : 'jpg'
29          const fileStream = fs.createWriteStream(`frontend/dist/frontend/assets/public/images/uploads/${loggedInUser.data.id}.${ext}`, { flags: 'w' })
30          await finished(Readable.fromWeb(response.body as any).pipe(fileStream))
31          const user = await UserModel.findByPk(loggedInUser.data.id)
32          await user?.update({ profileImage: `/assets/public/images/uploads/${loggedInUser.data.id}.${ext}` })
33        } catch (error) {
34          try {
35            const user = await UserModel.findByPk(loggedInUser.data.id)
36            await user?.update({ profileImage: url })
37            logger.warn(`Error retrieving user profile image: ${utils.getErrorMessage(error)}; using image link directly`)

8 more lines in the HTML report

108  trustProductDescription (tableData: any[]) {
109    for (let i = 0; i < tableData.length; i++) {
110      tableData[i].description = this.sanitizer.bypassSecurityTrustHtml(tableData[i].description)
111    }
112  }
113
114
115  ngOnDestroy () {
116    if (this.routerSubscription) {
117      this.routerSubscription.unsubscribe()
118    }
119
120    if (this.dataSource) {
121      this.dataSource.disconnect()
122    }
123
124    if (this.gridDataSourceSubscription) {
125      this.gridDataSourceSubscription.unsubscribe()
126    }
127
128    if (this.resizeObserver) {
129      this.resizeObserver.disconnect()
130    }
131  }
132
133  filterTable () {
134    let queryParam: string = this.route.snapshot.queryParams.q
135    if (queryParam) {
136      queryParam = queryParam.trim()
137      this.ngZone.runOutsideAngular(() => {

18 more lines in the HTML report

73        for (const user of this.userDataSource) {
74          user.email = this.sanitizer.bypassSecurityTrustHtml(`<span class="${this.doesUserHaveAnActiveSession(user) ? 'confirmation' : 'error'}">${user.email}</span>`)
75        }
76        this.userDataSource = new MatTableDataSource(this.userDataSource)
77        this.userDataSource.paginator = this.paginatorUsers
78        this.resultsLengthUser = users.length
79      },
80      error: (err) => {
81        this.error = err
82        console.log(this.error)
83      }
84    })
85  }
86
87  findAllFeedbacks () {
88    this.feedbackService.find().subscribe({
89      next: (feedbacks) => {
90        this.feedbackDataSource = feedbacks
91        for (const feedback of this.feedbackDataSource) {
92          feedback.comment = this.sanitizer.bypassSecurityTrustHtml(feedback.comment)

8 more lines in the HTML report

117          feedbacks[i].comment = `<figcaption><p class="feedback-comment">${
118            feedbacks[i].comment
119          }</p><div class="feedback-stars">(${this.stars[feedbacks[i].rating]})</div></figcaption>`
120          feedbacks[i].comment = this.sanitizer.bypassSecurityTrustHtml(
121            feedbacks[i].comment
122          )

38      if (payload.data.lastLoginIp) {
39
40        this.lastLoginIp = this.sanitizer.bypassSecurityTrustHtml(`<small>${payload.data.lastLoginIp}</small>`)

18      let lastLoginIp = req.headers['true-client-ip']
19      if (Array.isArray(lastLoginIp)) {
20        lastLoginIp = lastLoginIp[0]
21      }
22      if (utils.isChallengeEnabled(challenges.ch29ff72e7)) {
23      } else {
24        lastLoginIp = security.sanitizeSecure(lastLoginIp ?? '')
25      }
26      if (lastLoginIp === undefined) {
27        lastLoginIp = utils.toSimpleIpAddress(req.socket.remoteAddress ?? '')
28      }
29      try {
30        const user = await UserModel.findByPk(loggedInUser.data.id)
31        const updatedUser = await user?.update({ lastLoginIp: lastLoginIp?.toString() })

2 more lines in the HTML report

103      if (req.body.layout && utils.isChallengeEnabled(challenges.ch4086891b)) {
104        const filePath: string = path.resolve(req.body.layout).toLowerCase()
105        const isForbiddenFile: boolean = (filePath.includes('ftp') || filePath.includes('ctf.key') || filePath.includes('encryptionkeys'))
106        if (!isForbiddenFile) {
107          res.render('dataErasureResult', {
108            ...req.body,
109            ...themeVars
110          }, (error, html) => {
111            if (!html || error) {
112              next(new Error(error.message))
113            } else {
114              const sendlfrResponse: string = html.slice(0, 100) + '......'
115              res.send(sendlfrResponse)
116            }
117          })

3 more lines in the HTML report

97export const generateCoupon = (discount: number, date = new Date()) => {
98  const coupon = utils.toMMMYY(date) + '-' + discount
99  return z85.encode(coupon)
100}
101
102export const discountFromCoupon = (coupon?: string) => {
103  if (!coupon) {
104    return undefined
105  }
106  const decoded = z85.decode(coupon)
107  if (decoded && (hasValidFormat(decoded.toString()) != null)) {
108    const parts = decoded.toString().split('-')
109    const validity = parts[0]
110    if (utils.toMMMYY(new Date()) === validity) {
111      const discount = parts[1]
112      return parseInt(discount)
113    }
114  }
115}
116
117function hasValidFormat (coupon: string) {
118  return coupon.match(/(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)[0-9]{2}-[0-9]{2}/)
119}

11 more lines in the HTML report

42export const hmac = (data: string) => crypto.createHmac('sha256', 'pa4qacea4VK9t9nGv7yZtwmj').update(data).digest('hex')

40          const orderId = security.hash(email).slice(0, 4) + '-' + utils.randomHexString(16)
41          const pdfFile = `order_${orderId}.pdf`
42          const { default: PDFDocument } = await import('pdfkit')
43          const doc = new PDFDocument()
44          const date = new Date().toJSON().slice(0, 10)
45          const fileWriter = doc.pipe(fs.createWriteStream(path.join('ftp/', pdfFile)))

25  function verify (file: string, res: Response, next: NextFunction) {
26    if (file && (endsWithAllowlistedFileType(file) || (file === 'incident-support.kdbx'))) {
27      file = security.cutOffPoisonNullByte(file)
28
29      verifySuccessfulPoisonNullByteExploit(file)
30
31      res.sendFile(path.resolve('ftp/', file))
32    } else {
33      res.status(403)
34      next(new Error('Only .md and .pdf files are allowed!'))
35    }
36  }
37
38  function verifySuccessfulPoisonNullByteExploit (file: string) {
39
40  }
41
42  function endsWithAllowlistedFileType (param: string) {
43    return param.endsWith('.md') || param.endsWith('.pdf')
44  }

8 more lines in the HTML report

278  app.use('/ftp', serveIndexMiddleware, serveIndex('ftp', { icons: true }))
279  app.use('/ftp(?!/quarantine)/:file', servePublicFiles())

9      const { HDNodeWallet } = await import('ethers')
10      const mnemonic = 'purpose betray marriage blame crunch monitor spin slide donate sport lift clutch'
11      const mnemonicWallet = HDNodeWallet.fromPhrase(mnemonic)
12      const privateKey = mnemonicWallet.privateKey
13      const publicKey = mnemonicWallet.publicKey
14      const address = mnemonicWallet.address
15      if (req.body.privateKey === privateKey) {
16        res.status(200).json({ success: true, message: 'Challenge successfully solved', status: challenges.che9198e01 })

17      if (security.verify(req.cookies.token)) {
18        user = security.authenticatedUsers.get(req.cookies.token)
19
20        // Parse the fields parameter into an array, splitting by comma.
21        // If not provided, both these variables will be undefined.
22        const fieldsParam = req.query?.fields as string | undefined
23        const requestedFields = fieldsParam ? fieldsParam.split(',').map(f => f.trim()) : []
24
25        let baseUser: any = {}
26
27        if (requestedFields.length > 0) {
28          // When fields are specified, return only those fields
29          for (const field of requestedFields) {
30            if (user?.data[field as keyof typeof user.data] !== undefined) {
31              baseUser[field] = user?.data[field as keyof typeof user.data]
32            }
33          }

5 more lines in the HTML report

53    if (req.query.callback === undefined) {
54      res.json(response)
55    } else {
56      res.jsonp(response)
57    }

81export function buildSystemPrompt (userName?: string) {
82  const userIdentifier = userName ? `\nThe customer you are currently chatting with is ${userName}.` : ''
83  return `You are "${botName}", the friendly customer service chatbot of the ${appName} online store.
84You help customers find products, answer questions about the shop, and provide a delightful shopping experience.
85Keep your responses concise and helpful.${userIdentifier}

141      getProductReviews: tool({
142        description: 'Get all reviews for a specific product by its ID',
143        inputSchema: z.object({
144          id: z.string().describe('The product ID to get reviews for')
145        }),
146        execute: async ({ id }) => {
147          const productId = Number(id)
148          return await db.reviewsCollection.find({ $where: 'this.product == ' + productId }) as Review[]
149        }
150      }),

186    const model = config.get<string>('application.chatBot.model')
187    const messages = req.body?.messages ?? []
188    const userName = await getUserNameFromToken(req)
189
190    res.setHeader('Content-Type', 'text/event-stream')
191    res.setHeader('Cache-Control', 'no-cache, no-transform')
192    res.setHeader('Connection', 'keep-alive')
193    res.setHeader('Content-Encoding', 'identity')
194    res.flushHeaders()
195
196    const systemPrompt = buildSystemPrompt(userName)
197
198    try {
199      const result = streamText({
200        model: provider(model),
201        system: systemPrompt,
202        messages,
203        tools: { ...chatTools },

6 more lines in the HTML report

14export function createProductReviews () {
15  return async (req: Request, res: Response) => {
16    const user = security.authenticatedUsers.from(req)
17
18    try {
19      await reviewsCollection.insert({
20        product: req.params.id,
21        message: req.body.message,
22        author: req.body.author,
23        likesCount: 0,
24        likedBy: []
25      })