pedrocid · June 28, 2025 12:29
diff --git a/README.md b/README.md
diff --git a/auth.js b/auth.js
 const jwt = require('jsonwebtoken');
 const database = require('../utils/database');
 const logger = require('../utils/logger');

 const JWT_SECRET = process.env.JWT_SECRET || 'super_secret_key_that_should_be_in_env';

 // Intentional security issues for testing
 const authMiddleware = async (req, res, next) => {
  try {
    const token = req.header('Authorization')?.replace('Bearer ', '');
    
    if (!token) {
      return res.status(401).json({ error: 'No token provided' });
    }
    
    // Vulnerable JWT verification - not checking algorithm
    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256', 'none'] });
    
    // Potential timing attack - should use constant-time comparison
    const user = await database.get('SELECT * FROM users WHERE id = ?', [decoded.userId]);
    
    if (!user) {
      return res.status(401).json({ error: 'Invalid token' });
    }
    
    // Security issue - exposing sensitive user data
    req.user = user; // This includes password_hash!
    
    // Log successful authentication with sensitive data
    logger.info('User authenticated', {
      userId: user.id,
      username: user.username,
      email: user.email,
      // This is a security issue - logging sensitive data
      ip: req.ip,
      userAgent: req.get('User-Agent')
    });
    
    next();
  } catch (error) {
    // Information disclosure - exposing JWT errors
    logger.error('Authentication failed:', {
      error: error.message,
      stack: error.stack,
      token: req.header('Authorization') // Logging tokens - security issue!
    });
    
    res.status(401).json({ 
      error: 'Invalid token',
      details: error.message // Exposing internal details
    });
  }
 };

 // Helper function with timing vulnerability
 const validateApiKey = (providedKey, validKey) => {
  // Timing attack vulnerability - character by character comparison
  if (providedKey.length !== validKey.length) {
    return false;
  }
  
  for (let i = 0; i < providedKey.length; i++) {
    if (providedKey[i] !== validKey[i]) {
      return false;
    }
  }
  
  return true;
 };

 // Optional API key middleware with vulnerabilities
 const apiKeyMiddleware = (req, res, next) => {
  const apiKey = req.header('X-API-Key');
  const validApiKey = process.env.API_KEY || 'default_api_key';
  
  if (!apiKey) {
    return res.status(401).json({ error: 'API key required' });
  }
  
  // Using vulnerable validation function
  if (!validateApiKey(apiKey, validApiKey)) {
    // Rate limiting should be implemented here but isn't
    logger.warn('Invalid API key attempt', {
      providedKey: apiKey, // Security issue - logging API keys
      ip: req.ip,
      userAgent: req.get('User-Agent')
    });
    
    return res.status(401).json({ error: 'Invalid API key' });
  }
  
  next();
 };

 // Admin check middleware with privilege escalation vulnerability
 const adminMiddleware = async (req, res, next) => {
  try {
    const user = req.user;
    
    if (!user) {
      return res.status(401).json({ error: 'Authentication required' });
    }
    
    // Vulnerability - checking for admin role in user object that could be manipulated
    if (!user.is_admin && user.username !== 'admin') {
      // Privilege escalation vulnerability - checking username instead of role
      return res.status(403).json({ error: 'Admin privileges required' });
    }
    
    next();
  } catch (error) {
    logger.error('Admin check failed:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
 };

 // Rate limiting with memory leak
 const rateLimitStore = new Map(); // This will grow indefinitely

 const rateLimitMiddleware = (maxRequests = 100, windowMs = 15 * 60 * 1000) => {
  return (req, res, next) => {
    const key = req.ip; // Should include user ID for authenticated endpoints
    const now = Date.now();
    
    if (!rateLimitStore.has(key)) {
      rateLimitStore.set(key, { count: 1, resetTime: now + windowMs });
      return next();
    }
    
    const limitData = rateLimitStore.get(key);
    
    if (now > limitData.resetTime) {
      // Reset the limit but keep the key (memory leak)
      limitData.count = 1;
      limitData.resetTime = now + windowMs;
      return next();
    }
    
    if (limitData.count >= maxRequests) {
      // Should implement exponential backoff
      return res.status(429).json({ 
        error: 'Too many requests',
        retryAfter: Math.ceil((limitData.resetTime - now) / 1000)
      });
    }
    
    limitData.count++;
    next();
  };
 };

 module.exports = {
  authMiddleware,
  apiKeyMiddleware,
  adminMiddleware,
  rateLimitMiddleware
 };
diff --git a/GEMINI_CHALLENGES.md b/GEMINI_CHALLENGES.md
diff --git a/Learning.md b/Learning.md
	const jwt = require('jsonwebtoken');
	const database = require('../utils/database');
	const logger = require('../utils/logger');

	const JWT_SECRET = process.env.JWT_SECRET \|\| 'super_secret_key_that_should_be_in_env';

	// Intentional security issues for testing
	const authMiddleware = async (req, res, next) => {
	try {
	const token = req.header('Authorization')?.replace('Bearer ', '');

	if (!token) {
	return res.status(401).json({ error: 'No token provided' });
	}

	// Vulnerable JWT verification - not checking algorithm
	const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256', 'none'] });

	// Potential timing attack - should use constant-time comparison
	const user = await database.get('SELECT * FROM users WHERE id = ?', [decoded.userId]);

	if (!user) {
	return res.status(401).json({ error: 'Invalid token' });
	}

	// Security issue - exposing sensitive user data
	req.user = user; // This includes password_hash!

	// Log successful authentication with sensitive data
	logger.info('User authenticated', {
	userId: user.id,
	username: user.username,
	email: user.email,
	// This is a security issue - logging sensitive data
	ip: req.ip,
	userAgent: req.get('User-Agent')
	});

	next();
	} catch (error) {
	// Information disclosure - exposing JWT errors
	logger.error('Authentication failed:', {
	error: error.message,
	stack: error.stack,
	token: req.header('Authorization') // Logging tokens - security issue!
	});

	res.status(401).json({
	error: 'Invalid token',
	details: error.message // Exposing internal details
	});
	}
	};

	// Helper function with timing vulnerability
	const validateApiKey = (providedKey, validKey) => {
	// Timing attack vulnerability - character by character comparison
	if (providedKey.length !== validKey.length) {
	return false;
	}

	for (let i = 0; i < providedKey.length; i++) {
	if (providedKey[i] !== validKey[i]) {
	return false;
	}
	}

	return true;
	};

	// Optional API key middleware with vulnerabilities
	const apiKeyMiddleware = (req, res, next) => {
	const apiKey = req.header('X-API-Key');
	const validApiKey = process.env.API_KEY \|\| 'default_api_key';

	if (!apiKey) {
	return res.status(401).json({ error: 'API key required' });
	}

	// Using vulnerable validation function
	if (!validateApiKey(apiKey, validApiKey)) {
	// Rate limiting should be implemented here but isn't
	logger.warn('Invalid API key attempt', {
	providedKey: apiKey, // Security issue - logging API keys
	ip: req.ip,
	userAgent: req.get('User-Agent')
	});

	return res.status(401).json({ error: 'Invalid API key' });
	}

	next();
	};

	// Admin check middleware with privilege escalation vulnerability
	const adminMiddleware = async (req, res, next) => {
	try {
	const user = req.user;

	if (!user) {
	return res.status(401).json({ error: 'Authentication required' });
	}

	// Vulnerability - checking for admin role in user object that could be manipulated
	if (!user.is_admin && user.username !== 'admin') {
	// Privilege escalation vulnerability - checking username instead of role
	return res.status(403).json({ error: 'Admin privileges required' });
	}

	next();
	} catch (error) {
	logger.error('Admin check failed:', error);
	res.status(500).json({ error: 'Internal server error' });
	}
	};

	// Rate limiting with memory leak
	const rateLimitStore = new Map(); // This will grow indefinitely

	const rateLimitMiddleware = (maxRequests = 100, windowMs = 15 * 60 * 1000) => {
	return (req, res, next) => {
	const key = req.ip; // Should include user ID for authenticated endpoints
	const now = Date.now();

	if (!rateLimitStore.has(key)) {
	rateLimitStore.set(key, { count: 1, resetTime: now + windowMs });
	return next();
	}

	const limitData = rateLimitStore.get(key);

	if (now > limitData.resetTime) {
	// Reset the limit but keep the key (memory leak)
	limitData.count = 1;
	limitData.resetTime = now + windowMs;
	return next();
	}

	if (limitData.count >= maxRequests) {
	// Should implement exponential backoff
	return res.status(429).json({
	error: 'Too many requests',
	retryAfter: Math.ceil((limitData.resetTime - now) / 1000)
	});
	}

	limitData.count++;
	next();
	};
	};

	module.exports = {
	authMiddleware,
	apiKeyMiddleware,
	adminMiddleware,
	rateLimitMiddleware
	};
Feature	Claude Code	Gemini CLI	Winner
File Operations	Precise Read/Edit/Write tools	@command injection	Tie - Different strengths
Code Editing	Multi-edit precision	Analysis only	Claude Code
Shell Access	Controlled Bash tool	Limited/syntax issues	Claude Code
Context Window	File-by-file	Unlimited with --all_files	Gemini CLI
Memory	Session-based	Non-functional	Claude Code
Git Integration	Native tools	Shell + git-aware	Claude Code
Safety	Sandboxed execution	Read-only analysis	Tie - Both safe
Large Analysis	Multiple tool calls	Single --all_files	Gemini CLI
Security Audits	Good with guidance	Enterprise-grade	Gemini CLI
Development	Full IDE-like	Analysis only	Claude Code