completed
harbor-labs/checkout-api#1842
Harden order lookup and restore sessions from cache
5 findings: 4 security, 1 performance. 3 rated high or critical.
user_id is interpolated into SQL. An attacker can append OR 1=1 or UNION SELECT and read other customers' orders.
Flagged code
query = f"SELECT * FROM orders WHERE user_id = '{user_id}' AND status = 'active'"Suggested fix
from sqlalchemy import text
stmt = text("SELECT * FROM orders WHERE user_id = :user_id AND status = 'active'")
cursor.execute(stmt, {"user_id": user_id})
Test stub
def test_get_user_orders_rejects_injection(client):
response = client.get("/orders", params={"user_id": "1' OR '1'='1"})
assert response.status_code in {400, 404}