Case files / Code review

Before / After code

These are synthetic, non-production code examples showing authorization and idempotency failure modes.

CWE-639

Object-level authorization

The handler looks up an invoice using the client's object ID alone.

Vulnerable

// Unsafe: the ID is entirely client-controlled
const invoice = await db.invoice.findUnique({
  where: { id: params.invoiceId }
});
return json(invoice);

Fixed pattern

// Server-authenticated tenant, not client-supplied
const invoice = await db.invoice.findFirst({
  where: {
    id: params.invoiceId,
    tenantId: session.tenantId
  }
});
if (!invoice) return json({error: 'not_found'}, 404);
return json(invoice);

Verification: A user from tenant A cannot read tenant B's invoice; tenant-owned access still succeeds.

CWE-915

Mass assignment and role changes

The request body can replace a server-owned role field.

Vulnerable

// Unsafe: a caller can submit { role: 'admin' }
Object.assign(account, request.body);
await db.save(account);

Fixed pattern

// Validate known writable input fields only
const input = parseProfileUpdate(request.body);
account.displayName = input.displayName;
// account.role is never assigned from this body
await db.save(account);

Verification: Changing displayName is allowed; trying to submit role is rejected.

CWE-841

Duplicate writes on API retries

A retry can repeat a write because every request invokes the side effect.

Vulnerable

// Unsafe: retrying executes the effect again
const transfer = await createTransfer(input);
return json(transfer, 201);

Fixed pattern

// Atomic durable coordination required in production
const result = await store.executeOnce({
  principalId: session.userId,
  key: request.headers.get('Idempotency-Key'),
  fingerprint: canonicalDigest(input),
  action: () => createTransfer(input)
});
return json(result.body, result.status);

Verification: Two identical requests produce one effect and the same logical result; mismatched payloads fail.

← Case files