[LEGIT] Fix - Dynamic code execution should not be vulnerable to injection attacks

[eli-tamarkin-legit]

🔍 The problem

Change this code to not dynamically execute code influenced by user-controlled data.
See issue in Legit

🔒 Fix Details

The vulnerability arises from the use of eval() to parse user input, which can lead to code injection attacks. To remediate this, we replace the eval() calls with parseFloat() to safely parse the input as numbers. This prevents execution of arbitrary code while preserving the intended functionality of parsing numeric input. The commented-out fix in the original code used parseInt(), but parseFloat() is more appropriate if decimal values are expected. This change is applied only to line 24, 25, and 26 where eval() is used.

--- a/app/routes/contributions.js
+++ b/app/routes/contributions.js
@@ -21,9 +21,9 @@
 
         /*jslint evil: true */
         // Insecure use of eval() to parse inputs
-        const preTax = eval(req.body.preTax);
-        const afterTax = eval(req.body.afterTax);
-        const roth = eval(req.body.roth);
+        const preTax = parseFloat(req.body.preTax);
+        const afterTax = parseFloat(req.body.afterTax);
+        const roth = parseFloat(req.body.roth);
 
         /*
         //Fix for A1 -1 SSJS Injection attacks - uses alternate method to eval

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE