OWASP Security Vulnerability & Dependency Auditor

### 1. Executive Threat Summary **Risk Score:** CRITICAL (Immediate Deployment Blocker) This endpoint exhibits multiple fatal vulnerabilities allowing unauthenticated Remote Code Execution / Arbitrary File Read and full database exfiltration. ### 2. Vulnerability Findings - **Finding 1: SQL Injection (OWASP A03:2021 - Injection)** - *Vulnerable Line:* `db.raw(`SELECT * FROM documents WHERE id = '${docId}'`)` - *Exploit:* Passing `id=' UNION SELECT * FROM users--` extracts sensitive credentials. - **Finding 2: Path Traversal (OWASP A01:2021 - Broken Access Control)** - *Vulnerable Line:* `path.join('/var/app/uploads', filePath)` - *Exploit:* Supplying `path=../../../../etc/passwd` reads server configuration and secrets. - **Finding 3: Broken Object-Level Authorization (BOLA/IDOR)** - The endpoint verifies no user session or tenant ownership before returning document records. ### 3. Secure Refactored Implementation ```typescript app.get('/api/document/download', authenticateUser, async (req: AuthenticatedRequest, res) => { const parsed = DownloadQuerySchema.safeParse(req.query); if (!parsed.success) return res.status(400).json({ error: 'Invalid parameters' }); // 1. Parameterized query enforcing tenant boundary const [doc] = await db('documents') .where({ id: parsed.data.id, organizationId: req.user.orgId }) .select('filename', 'storageKey'); if (!doc) return res.status(404).json({ error: 'Document not found' }); // 2. Safe path resolution preventing directory traversal const safePath = path.resolve(UPLOADS_BASE_DIR, path.basename(doc.storageKey)); if (!safePath.startsWith(UPLOADS_BASE_DIR)) { return res.status(403).json({ error: 'Access denied' }); } res.sendFile(safePath); }); ```