feat(routes): add catalog description lookup (rerun)

[ogulcan-gurcaglar]

Controlled re-run: tree is byte-identical to the pre-deploy probe branch, so discovery prompts hit the AI cache and only the confirmation stage differs.

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 1160422.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/productLookup.ts:13
  • Score: HIGH (88.0)
  • Description: The newly exposed /rest/products/lookup endpoint interpolates the attacker-controlled term query parameter directly into a raw SQL statement. An anonymous user can inject SQL syntax through term, altering the query and potentially extracting or modifying data available to the database connection.

Evidence: const term = req.query.term ?? '' reads the HTTP query parameter, and line 13 constructs SELECT ... WHERE description LIKE '%${term}%' without parameter binding or escaping. The route is mounted at line 572 without an authentication middleware.

• Link to UI: https://staging.branch.zeropath.com/app/issues/83007ff0-10ca-4dc3-a4e4-07bc893a4ac2 (Issue 1, id: 83007ff0-10ca-4dc3-a4e4-07bc893a4ac2)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=afe77c8a-b682-4035-a7e9-dabf19b6aca2&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/productLookup.ts     Add productLookup route for catalog description search ► server.ts     Register /rest/products/lookup route with productLookup handler

[zeropath-ai-staging]

SQL Injection in /rest/products/lookup (routes/productLookup.ts) (Severity: HIGH)

Security impact: an attacker can inject SQL via the term query parameter, potentially reading or modifying data. The code interpolates req.query.term directly into a raw SQL string in line 13, which is executed by Sequelize without parameter binding, leading to data exposure or corruption and occurs on the public route mounted at line 572.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT name, description FROM Products WHERE description LIKE '%${term}%' AND deletedAt IS NULL ORDER BY name ASC`)
	models.sequelize.query('SELECT name, description FROM Products WHERE description LIKE :term AND deletedAt IS NULL ORDER BY name ASC', { replacements: { term: `%${term}%` } })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 1160422.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/productLookup.ts:13
  • Score: HIGH (87.0)
  • Description: The newly exposed /rest/products/lookup endpoint interpolates the attacker-controlled term query parameter directly into a Sequelize raw SQL query. An unauthenticated caller can inject SQL syntax through term, altering the WHERE clause and potentially extracting or modifying database data depending on the SQLite/Sequelize connection capabilities.

Evidence: const term = req.query.term ?? '' reads request query input, and line 13 constructs ... WHERE description LIKE '%${term}%' ... without replacements, bind parameters, or escaping before models.sequelize.query(...). The route is registered as app.get('/rest/products/lookup', productLookup()) with no authentication middleware.

• Link to UI: https://staging.branch.zeropath.com/app/issues/1a1ec228-1734-41f1-8070-f2763e437119 (Issue 1, id: 1a1ec228-1734-41f1-8070-f2763e437119)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=7f193d1d-c58c-4ba1-8f75-df80ca8194da&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/productLookup.ts     Add productLookup route for catalog description search ► server.ts     Register /rest/products/lookup route with productLookup handler

[zeropath-ai-staging]

SQL Injection in /rest/products/lookup (routes/productLookup.ts) (Severity: HIGH)

The endpoint allows unauthenticated users to inject SQL via the term query parameter, which is interpolated directly into a Sequelize raw query, potentially exposing or altering data. This causes the WHERE clause to be manipulated because term is interpolated into the query string without parameter binding or escaping, leading to unauthorized data access depending on SQLite/Sequelize configurations.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT name, description FROM Products WHERE description LIKE '%${term}%' AND deletedAt IS NULL ORDER BY name ASC`)
	models.sequelize.query('SELECT name, description FROM Products WHERE description LIKE :term AND deletedAt IS NULL ORDER BY name ASC', { replacements: { term: `%${term}%` } })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}