feat(routes): add product revenue lookup (rerun)

[ogulcan-gurcaglar]

Controlled re-run: tree is byte-identical to the pre-deploy probe branch, so discovery prompts hit the AI cache and only the confirmation stage differs.

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 632a124.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/productRevenue.ts:14
  • Score: HIGH (84.0)
  • Description: The newly mounted /rest/products/revenue endpoint accepts the query-string name value from an unauthenticated request and interpolates it directly into a SQL LIKE clause. An anonymous attacker can submit quotes and SQL syntax to alter the query, potentially extracting or modifying database data depending on the database driver's multi-statement/query behavior.

Evidence: server.ts:572 mounts productRevenue() without visible authentication middleware, and routes/productRevenue.ts:13-14 assigns req.query.name directly into a raw SQL template string without parameter binding or escaping.

• Link to UI: https://staging.branch.zeropath.com/app/issues/ba7d83bb-f930-4bf3-b0b4-45d304f81a79 (Issue 1, id: ba7d83bb-f930-4bf3-b0b4-45d304f81a79)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=2c679b17-7d2f-4290-ae4f-8e8d771b319d&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/productRevenue.ts       Add product revenue lookup endpoint for merchant dashboard ► server.ts       Register new /rest/products/revenue route connected to productRevenue handler

[zeropath-ai-staging]

SQL Injection in /rest/products/revenue (routes/productRevenue.ts) (Severity: HIGH)

This SQL injection risk allows an unauthenticated user to inject SQL via the name query parameter, which is interpolated directly into a LIKE clause in productRevenue, leading to potential data disclosure or modification. The vulnerability arises from building the query with string interpolation in routes/productRevenue.ts lines 13-14, and mounting the endpoint in server.ts:572 without authentication middleware, which causes unvalidated input to reach the database.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT id, name, price FROM Products WHERE name LIKE '%${name}%' AND deletedAt IS NULL ORDER BY price DESC`)
	models.sequelize.query('SELECT id, name, price FROM Products WHERE name LIKE ? AND deletedAt IS NULL ORDER BY price DESC', { replacements: [`%${name}%`] })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 632a124.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/productRevenue.ts:14
  • Score: HIGH (86.0)
  • Description: The newly exposed GET endpoint interpolates the attacker-controlled name query parameter directly into a raw SQL statement. Because the route is registered without any authentication or authorization middleware, any remote caller can inject SQL through name, alter the WHERE clause, and retrieve unintended product data (or use SQLite-specific expressions/subqueries depending on the payload).

Evidence: server.ts:572 registers app.get('/rest/products/revenue', productRevenue()) with no security middleware; routes/productRevenue.ts:13-14 takes req.query.name and inserts it into LIKE '%${name}%' in sequelize.query(...) without replacements/bind parameters or escaping.

• Link to UI: https://staging.branch.zeropath.com/app/issues/74c71b7e-27f1-4cc5-866a-0064a1b4bf36 (Issue 1, id: 74c71b7e-27f1-4cc5-866a-0064a1b4bf36)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=50fe7f65-6a2f-4fd3-a9f7-4ddf3adc6e12&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/productRevenue.ts       Add product revenue lookup endpoint for merchant dashboard ► server.ts       Register new /rest/products/revenue route connected to productRevenue handler

[zeropath-ai-staging]

SQL Injection in /rest/products/revenue (routes/productRevenue.ts:14) (Severity: HIGH)

The endpoint is exploitable by remote attackers who can inject SQL via the name query parameter, which causes the raw query to include unescaped input in the LIKE clause and return unintended data. This is worsened by the route registering without authentication or authorization, leading to unauthorized access to product data via /rest/products/revenue?name=...
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT id, name, price FROM Products WHERE name LIKE '%${name}%' AND deletedAt IS NULL ORDER BY price DESC`)
	models.sequelize.query('SELECT id, name, price FROM Products WHERE name LIKE :name AND deletedAt IS NULL ORDER BY price DESC', { replacements: { name: `%${name}%` } })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}