openpitstop 1.5.1 → 1.6.0

package/demo/web-app-broken/src/server.js

@@ -19,6 +19,15 @@ const accounts = [
   { id: 2, name: "bob", email: "bob@minishop.dev", password: "bob123", isAdmin: true },
 ];
 
+// In-memory catalog + order/cart stores so MiniShop feels like a real shop.
+const products = [
+  { id: 1, name: "USB-C Cable", price: 9.99, stock: 50 },
+  { id: 2, name: "Mechanical Keyboard", price: 79.0, stock: 12 },
+  { id: 3, name: "4K Webcam", price: 49.5, stock: 8 },
+];
+const orders = [];
+const carts = {};
+
 // BUG: command injection — host flows from query string into a shell.
 app.get("/api/ping", (req, res) => {
   exec(`ping -c 1 ${req.query.host || "localhost"}`, (err, out) => {
@@ -90,6 +99,47 @@ app.get("/", (req, res) => {
   res.sendFile(__dirname + "/../views/index.html");
 });
 
+// Catalog.
+app.get("/api/products", (req, res) => res.json(products));
+app.get("/api/products/:id", (req, res) => {
+  const p = products.find((x) => x.id === Number(req.params.id));
+  res.json(p || null);
+});
+
+// Cart — no auth, no validation, trusts any body.
+app.post("/api/cart", (req, res) => {
+  const { userId, productId, qty } = req.body;
+  carts[userId] = carts[userId] || [];
+  carts[userId].push({ productId, qty });
+  res.json({ cart: carts[userId] });
+});
+
+// BUG: price tampering — the server totals the cart from CLIENT-supplied
+// prices, so a shopper can checkout a $79 keyboard for $0.01.
+app.post("/api/checkout", (req, res) => {
+  const items = req.body.items || [];
+  let total = 0;
+  for (const it of items) total += it.price * it.qty; // client controls price
+  const order = { id: orders.length + 1, userId: req.body.userId || 1, total, items };
+  orders.push(order);
+  res.json({ orderId: order.id, total });
+});
+
+// BUG: IDOR — any caller can read ANY order by id, no authz/ownership check.
+app.get("/api/orders/:id", (req, res) => {
+  const order = orders.find((o) => o.id === Number(req.params.id));
+  if (!order) return res.status(404).json({ error: "not found" });
+  res.json(order);
+});
+
+// BUG: prototype pollution — untrusted body merged via lodash.merge
+// (lodash@4.17.4 is CVE-2019-10744).
+app.patch("/api/profile", (req, res) => {
+  const profile = {};
+  users.mergeProfile(profile, req.body);
+  res.json({ ok: true, profile });
+});
+
 if (require.main === module) {
   const port = process.env.PORT || 3000;
   app.listen(port, () => console.log(`minishop listening on ${port}`));

package/demo/web-app-fixed/src/server.js

@@ -30,6 +30,15 @@ const accounts = [
   { id: 2, name: "bob", email: "bob@minishop.dev", password: process.env.DEMO_BOB_HASH || "", isAdmin: true },
 ];
 
+// In-memory catalog + order/cart stores (demo stand-ins for the real DB).
+const products = [
+  { id: 1, name: "USB-C Cable", price: 9.99, stock: 50 },
+  { id: 2, name: "Mechanical Keyboard", price: 79.0, stock: 12 },
+  { id: 3, name: "4K Webcam", price: 49.5, stock: 8 },
+];
+const orders = [];
+const carts = {};
+
 function escapeHtml(s) {
   return String(s).replace(/[&<>"']/g, (c) =>
     ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]),
@@ -149,6 +158,58 @@ app.get("/", (req, res) => {
   res.sendFile(path.join(__dirname, "..", "views", "index.html"));
 });
 
+// Catalog.
+app.get("/api/products", (req, res) => res.json(products));
+app.get("/api/products/:id", (req, res) => {
+  const p = products.find((x) => x.id === Number(req.params.id));
+  res.json(p || null);
+});
+
+// FIXED: cart validated; no untrusted bodies trusted blindly.
+app.post("/api/cart", requireAuth, (req, res) => {
+  const { userId, productId, qty } = req.body;
+  const product = products.find((x) => x.id === Number(productId));
+  if (!product) return res.status(400).json({ error: "unknown product" });
+  const n = Math.max(0, Math.floor(Number(qty) || 0));
+  carts[userId] = carts[userId] || [];
+  carts[userId].push({ productId, qty: n });
+  res.json({ cart: carts[userId] });
+});
+
+// FIXED: total computed from CATALOG prices (server-side), auth required,
+// quantities validated — price tampering is impossible.
+app.post("/api/checkout", requireAuth, (req, res) => {
+  const items = req.body.items || [];
+  let total = 0;
+  for (const it of items) {
+    const product = products.find((x) => x.id === Number(it.productId));
+    if (!product) return res.status(400).json({ error: "unknown product" });
+    const qty = Math.max(0, Math.floor(Number(it.qty) || 0));
+    total += product.price * qty;
+  }
+  const order = { id: orders.length + 1, userId: req.user.sub, total, items };
+  orders.push(order);
+  res.json({ orderId: order.id, total });
+});
+
+// FIXED: ownership check — only the owner (or an admin) can read an order.
+app.get("/api/orders/:id", requireAuth, (req, res) => {
+  const order = orders.find((o) => o.id === Number(req.params.id));
+  if (!order) return res.status(404).json({ error: "not found" });
+  const me = accounts.find((a) => a.id === req.user.sub);
+  if (order.userId !== req.user.sub && !me?.isAdmin) {
+    return res.status(403).json({ error: "forbidden" });
+  }
+  res.json(order);
+});
+
+// FIXED: prototype-pollution sink removed — only allow-listed fields copied.
+app.patch("/api/profile", requireAuth, (req, res) => {
+  const profile = {};
+  users.mergeProfile(profile, req.body);
+  res.json({ ok: true, profile });
+});
+
 if (require.main === module) {
   const port = process.env.PORT || 3000;
   app.listen(port, () => console.log(`minishop listening on ${port}`));