feat(chaos): add nine reporting endpoints - #33
Conversation
|
❌ 2 possible security or compliance issues detected. Reviewed everything up to b30a6f3. The following issues were found:
Evidence: server.ts lines 583-591 mount the chaos handlers without an auth middleware; chaosRoute1.ts line 11 reads req.query.q1 and line 12 inserts it into
Evidence: server.ts lines 583-591 publicly mount all chaos endpoints with no security.isAuthorized() middleware; chaosRoute2.ts line 11 reads req.query.q2 and line 12 constructs SQL using string interpolation.
Security Overview
Detected Code Changes
|
![zeropath-ai-staging[bot]](https://avatars.githubusercontent.com/in/1190428?s=60&v=4){kind=small}
| module.exports = function chaosRoute2 () { | ||
| return (req: Request, res: Response, next: NextFunction) => { | ||
| const q2 = req.query.q2 ?? '' | ||
| models.sequelize.query(`SELECT * FROM Products WHERE name = '${q2}'`) |
There was a problem hiding this comment.
SQL Injection via unauthenticated chaos endpoints (routes/chaosRoute2.ts) (Severity: HIGH)
The endpoint is exposed without authentication, and q2 from req.query is directly interpolated into a raw SQL query, which causes an attacker-controlled input to execute arbitrary SQL. This vulnerable pattern is mirrored for /rest/chaos/3 through /rest/chaos/9, with server.ts mounting all chaos routes without isAuthorized() middleware, leading to potential data leakage or modification.
View details in ZeroPath
Automatic patch generation was not possible for this finding.
💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.
|
❌ 2 possible security or compliance issues detected. Reviewed everything up to b30a6f3. The following issues were found:
Evidence:
Evidence:
Security Overview
Detected Code Changes
|
| module.exports = function chaosRoute1 () { | ||
| return (req: Request, res: Response, next: NextFunction) => { | ||
| const q1 = req.query.q1 ?? '' | ||
| models.sequelize.query(`SELECT * FROM Products WHERE name = '${q1}'`) |
There was a problem hiding this comment.
SQL Injection on /rest/chaos/1 Route (Severity: CRITICAL)
An attacker can inject SQL via q1 in /rest/chaos, which causes a raw query building with user input to execute unauthorized data access. The code reads req.query.q1 and interpolates it into the statement SELECT * FROM Products WHERE name = '${q1}' with no auth checks on /rest/chaos, leading to possible data leakage or manipulation.
View details in ZeroPath
| models.sequelize.query(`SELECT * FROM Products WHERE name = '${q1}'`) | |
| models.sequelize.query('SELECT * FROM Products WHERE name = ?', { replacements: [q1] }) |
💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.
| module.exports = function chaosRoute1 () { | ||
| return (req: Request, res: Response, next: NextFunction) => { | ||
| const q1 = req.query.q1 ?? '' | ||
| models.sequelize.query(`SELECT * FROM Products WHERE name = '${q1}'`) |
There was a problem hiding this comment.
SQL Injection in chaosRoute1 public endpoint (Severity: HIGH)
The endpoint allows an attacker-controlled q1 parameter to terminate the string and append arbitrary SQL, which causes exposure of product data via a raw query without parameter binding. This results in potential data leakage and unintended access; the vulnerability exists in routes/chaosRoute1.ts line 12 where the query is constructed without replacements, and is similarly replicated in chaosRoute2 through chaosRoute9, with the route registered publicly in server.ts line 583.
View details in ZeroPath
| models.sequelize.query(`SELECT * FROM Products WHERE name = '${q1}'`) | |
| models.sequelize.query('SELECT * FROM Products WHERE name = :q1', { replacements: { q1 } }) |
💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.
| module.exports = function chaosRoute2 () { | ||
| return (req: Request, res: Response, next: NextFunction) => { | ||
| const q2 = req.query.q2 ?? '' | ||
| models.sequelize.query(`SELECT * FROM Products WHERE name = '${q2}'`) |
There was a problem hiding this comment.
SQL Injection in chaosRoute2.ts (unsanitized query) (Severity: HIGH)
The vulnerability allows attackers to inject SQL via q2, which is directly interpolated into a raw query in chaosRoute2.ts, resulting in unauthorized data access. This occurs because the code builds the SQL string with the attacker-controlled q2 value without binding or escaping, and the same sink exists in chaosRoute3.ts through chaosRoute9.ts.
View details in ZeroPath
| models.sequelize.query(`SELECT * FROM Products WHERE name = '${q2}'`) | |
| models.sequelize.query('SELECT * FROM Products WHERE name = :q2', { replacements: { q2 } }) |
💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.
1 participant
Adds nine reporting endpoints for the operations console.