fix(logistics): allow partial carrier names in shipment trace

[ogulcan-gurcaglar]

Allows partial carrier names. The handler is mounted through the logistics router.

[zeropath-ai-staging]

✅ No security or compliance issues detected. Reviewed everything up to b90a5a7.

Security Overview

• 🔎 Scanned files: 1 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=cd64fa26-b0a0-4801-843a-d734fd6964ac&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Bug Fix	► routes/shipmentTrace.ts     Modify SQL query to use string interpolation for carrier value

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to b90a5a7.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/shipmentTrace.ts:13
  • Score: CRITICAL (90.0)
  • Description: The carrier query parameter is interpolated directly into a SQL string. An unauthenticated attacker can submit quote-based SQL payloads to alter the WHERE clause and potentially read arbitrary data returned by the query.

Evidence: Line 13 changes a parameterized query using replacements: [carrier] to SELECT * FROM Deliveries WHERE name = '${carrier}', placing attacker-controlled req.query.carrier inside SQL syntax without escaping or parameter binding.

• Link to UI: https://staging.branch.zeropath.com/app/issues/4e98d73d-66dd-4ce5-965d-2b55753b292e (Issue 1, id: 4e98d73d-66dd-4ce5-965d-2b55753b292e)

Security Overview

• 🔎 Scanned files: 1 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=09aaf936-91d5-4225-871a-bb72d791b6d7&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Bug Fix	► routes/shipmentTrace.ts     Modify SQL query to use string interpolation for carrier value

[zeropath-ai-staging]

SQL Injection in shipmentTrace route (routes/shipmentTrace.ts) (Severity: CRITICAL)

The query parameter carrier is interpolated directly into SQL, which can lead to an unauthenticated attacker altering the WHERE clause and reading arbitrary data. This occurs because the code uses a string-concatenated query in lines around the shipmentTrace function instead of parameter binding, resulting in possible quote-based payloads and data exposure.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT * FROM Deliveries WHERE name = '${carrier}'`)
	models.sequelize.query('SELECT * FROM Deliveries WHERE name = ?', { replacements: [carrier] })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}