Skip to content

feat(ops): add warehouse audit endpoint #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ogulcan-gurcaglar wants to merge 1 commit into
base: zp313-ubase
Choose a base branch
from
+22 −0
Open

feat(ops): add warehouse audit endpoint #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions routes/warehouseAudit.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/

import * as models from '../models/index'
import { type Request, type Response, type NextFunction } from 'express'

// Warehouse audit lookup for the operations console.
module.exports = function warehouseAudit () {
return (req: Request, res: Response, next: NextFunction) => {
const zone = req.query.zone ?? ''
models.sequelize.query(`SELECT * FROM Products WHERE description LIKE '%${zone}%'`)

@zeropath-ai-staging zeropath-ai-staging Bot Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SQL Injection in /rest/warehouse/audit (warehouseAudit.ts) (Severity: CRITICAL)

The route allows unauthenticated access which can lead to data exposure. It interpolates req.query.zone directly into a SQL statement, causing injection that could read arbitrary tables; this is performed without parameter binding, resulting in the returned rows in the JSON response.
View details in ZeroPath

Suggested change
models.sequelize.query(`SELECT * FROM Products WHERE description LIKE '%${zone}%'`)
models.sequelize.query('SELECT * FROM Products WHERE description LIKE ?', { replacements: [`%${zone}%`] })

💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.

All commands

@zeropath-ai-staging zeropath-ai-staging Bot Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SQL Injection in warehouseAudit endpoint (routes/warehouseAudit.ts) (Severity: HIGH)

SQL injection risk exposes or alters data because the zone query parameter is interpolated directly into a LIKE clause in a raw SQL query, which can be exploited by supplying special characters. This occurs in routes/warehouseAudit.ts line 13 where zone is read from req.query.zone and embedded in sequelize.query without parameter binding, leading to potentially unintended queries executed by GET /rest/warehouse/audit.
View details in ZeroPath

Suggested change
models.sequelize.query(`SELECT * FROM Products WHERE description LIKE '%${zone}%'`)
models.sequelize.query('SELECT * FROM Products WHERE description LIKE :zone', { replacements: { zone: `%${zone}%` } })

💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.

All commands

.then(([rows]: any) => {
res.json({ zone, rows })
}).catch((error: Error) => {
next(error)
})
}
}
2 changes: 2 additions & 0 deletions server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ const updateProductReviews = require('./routes/updateProductReviews')
const likeProductReviews = require('./routes/likeProductReviews')
const security = require('./lib/insecurity')
const orderAudit = require('./routes/orderAudit')
const warehouseAudit = require('./routes/warehouseAudit')
const { logisticsRouter } = require('./routes/logisticsRouter')
const app = express()
const server = require('http').Server(app)
Expand Down Expand Up @@ -574,6 +575,7 @@ restoreOverwrittenFilesWithOriginals().then(() => {
app.post('/rest/basket/:id/checkout', order())
app.put('/rest/basket/:id/coupon/:coupon', coupon())
app.get('/rest/orders/audit', orderAudit())
app.get('/rest/warehouse/audit', warehouseAudit())
app.use('/rest/logistics', logisticsRouter)
app.get('/rest/admin/application-version', appVersion())
app.get('/rest/admin/application-configuration', appConfiguration())
Expand Down