feat(hostile): add reporting endpoints with awkward path names by ogulcan-gurcaglar · Pull Request #34 · ZeroPathAI/juice-shop-forked

ogulcan-gurcaglar · 2026-09-09T13:58:32Z

Adds four reporting endpoints. Paths follow the existing localisation naming.

zeropath-ai-staging · 2026-09-09T14:00:57Z

❌ 2 possible security or compliance issues detected. Reviewed everything up to 32ab4b1.

The following issues were found:

Issue 1: SQL Injection
- Location: routes/-dashdir/audit.ts:12
- Score: HIGH (88.0)
- Description: The newly exposed /rest/hostile/dash endpoint interpolates the attacker-controlled qd query parameter directly into a SQL statement. An unauthenticated caller can alter the WHERE clause or append SQL, potentially reading or modifying database data depending on SQLite/Sequelize behavior.

Evidence: const qd = req.query.qd ?? '' is taken directly from the request, and line 12 executes SELECT * FROM Baskets WHERE name = '${qd}' without replacements, bind parameters, or escaping. The route is registered with app.get('/rest/hostile/dash', dashDirAudit()) and has no visible authorization middleware.

Link to UI: https://staging.branch.zeropath.com/app/issues/9de38668-092f-432a-a574-b6373c76280c (Issue 1, id: 9de38668-092f-432a-a574-b6373c76280c)

Issue 2: SQL Injection
- Location: routes/o'brien.ts:12
- Score: HIGH (83.0)
- Description: The newly exposed /rest/hostile/quote endpoint interpolates the attacker-controlled qb query parameter directly into a SQL statement. An unauthenticated caller can manipulate the query and potentially extract or alter database data depending on database driver behavior.

Evidence: const qb = req.query.qb ?? '' comes from the request, and line 12 executes SELECT * FROM Cards WHERE name = '${qb}' without bind parameters, replacements, or escaping. The route is registered as app.get('/rest/hostile/quote', obrienReport()) with no visible authorization middleware.

Link to UI: https://staging.branch.zeropath.com/app/issues/088e5d09-f384-46b9-b491-a58bd0d6549c (Issue 2, id: 088e5d09-f384-46b9-b491-a58bd0d6549c)

Security Overview

🔎 Scanned files: 6 changed file(s)
🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=f6985508-ff3f-47ea-b66b-7389c64866b9&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/-dashdir/audit.ts Add new audit endpoint for dashdir queries ► routes/o'brien.ts Add new obrienReport route to serve Cards data ► routes/quarterly report.ts Add new quarterlyReportSpace route to serve Orders data ► routes/rapport-cafüe.ts Add new rapportCafe route to serve Addresses data ► server.ts Wire new hostile routes (dash, quote, unicode, quarterly report) into app

zeropath-ai-staging · 2026-09-09T14:00:59Z

+module.exports = function dashDirAudit () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const qd = req.query.qd ?? ''
+    models.sequelize.query(`SELECT * FROM Baskets WHERE name = '${qd}'`)


SQL Injection in /rest/hostile/dash (routes/-dashdir/audit.ts) (Severity: HIGH)

The endpoint allows unauthenticated access and uses a user-supplied qd parameter directly in a SQL string, which causes an SQL injection risk that could read or modify data. The code reads qd from req.query and interpolates it into the query on line 12 as SELECT * FROM Baskets WHERE name = '${qd}', which leads to potential data exposure or manipulation depending on the database driver.
_{View details in ZeroPath}

Suggested change

models.sequelize.query(`SELECT * FROM Baskets WHERE name = '${qd}'`)

models.sequelize.query('SELECT * FROM Baskets WHERE name = ?', { replacements: [qd] })

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

zeropath-ai-staging · 2026-09-09T14:01:00Z

+module.exports = function obrienReport () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const qb = req.query.qb ?? ''
+    models.sequelize.query(`SELECT * FROM Cards WHERE name = '${qb}'`)


SQL Injection in /rest/hostile/quote (routes/o'brien.ts:12) (Severity: HIGH)

Unauthenticated users can manipulate the qb query parameter which causes the app to interpolate it directly into a SQL statement, leading to potential data leakage or modification via the Cards table. The code in routes/o'brien.ts line 12 builds the query without parameters or escaping, resulting in a risky query execution path when /rest/hostile/quote is requested.
_{View details in ZeroPath}

Suggested change

models.sequelize.query(`SELECT * FROM Cards WHERE name = '${qb}'`)

models.sequelize.query('SELECT * FROM Cards WHERE name = :qb', { replacements: { qb } })

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

zeropath-ai-staging · 2026-09-09T14:01:05Z

❌ 4 possible security or compliance issues detected. Reviewed everything up to 32ab4b1.

The following issues were found:

Issue 1: SQL Injection
- Location: server.ts:581
- Score: CRITICAL (91.0)
- Description: The newly added public /rest/hostile/dash endpoint invokes a handler that directly interpolates attacker-controlled qd into a raw SQL query over Baskets. Anonymous attackers can inject SQL and disclose basket contents or arbitrary database data.

Evidence: server.ts mounts app.get('/rest/hostile/dash', dashDirAudit()) without authentication or authorization. The handler executes SELECT * FROM Baskets WHERE name = '${qd}' and returns the rows as JSON.

Link to UI: https://staging.branch.zeropath.com/app/issues/334abcad-f275-4779-a007-19a2cfda826a (Issue 1, id: 334abcad-f275-4779-a007-19a2cfda826a)

Issue 2: SQL Injection
- Location: server.ts:579
- Score: HIGH (89.0)
- Description: The newly added public /rest/hostile/quote endpoint invokes a handler that interpolates attacker-controlled qb directly into a raw SQL query over the Cards table. Anonymous attackers can inject SQL and retrieve payment-card records or arbitrary database data.

Evidence: server.ts mounts app.get('/rest/hostile/quote', obrienReport()) without authentication or authorization. The handler executes SELECT * FROM Cards WHERE name = '${qb}' and serializes the resulting rows into the response.

Link to UI: https://staging.branch.zeropath.com/app/issues/5c975f5d-0574-4010-a488-ea3fffc6f404 (Issue 2, id: 5c975f5d-0574-4010-a488-ea3fffc6f404)

Issue 3: SQL Injection
- Location: server.ts:580
- Score: HIGH (87.0)
- Description: The newly added public /rest/hostile/unicode endpoint invokes a handler that concatenates attacker-controlled qc into a raw SQL query over Addresses. An anonymous attacker can inject SQL to disclose other users' addresses or arbitrary database rows.

Evidence: server.ts mounts app.get('/rest/hostile/unicode', rapportCafe()) without authentication or authorization. The handler executes SELECT * FROM Addresses WHERE name = '${qc}' and returns rows as JSON.

Link to UI: https://staging.branch.zeropath.com/app/issues/5629d3f5-f44a-46e7-a63d-752d4ae9fbc9 (Issue 3, id: 5629d3f5-f44a-46e7-a63d-752d4ae9fbc9)

Issue 4: SQL Injection
- Location: server.ts:578
- Score: HIGH (83.0)
- Description: The newly added public /rest/hostile/space endpoint invokes a handler that interpolates the attacker-controlled qa query parameter directly into a raw SQL query. An anonymous requester can inject SQL and retrieve arbitrary database rows, including other users' order data and potentially data from other tables.

Evidence: server.ts mounts app.get('/rest/hostile/space', quarterlyReportSpace()) without authentication or authorization middleware. The newly added handler executes SELECT * FROM Orders WHERE name = '${qa}' and returns rows as JSON.

Link to UI: https://staging.branch.zeropath.com/app/issues/1584c2c0-221a-4afa-bbd7-5733a82510f4 (Issue 4, id: 1584c2c0-221a-4afa-bbd7-5733a82510f4)

Security Overview

🔎 Scanned files: 6 changed file(s)
🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=07d08dae-47e8-4ae3-98a4-9914cbbeec66&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/-dashdir/audit.ts Add new audit endpoint for dashdir queries ► routes/o'brien.ts Add new obrienReport route to serve Cards data ► routes/quarterly report.ts Add new quarterlyReportSpace route to serve Orders data ► routes/rapport-cafüe.ts Add new rapportCafe route to serve Addresses data ► server.ts Wire new hostile routes (dash, quote, unicode, quarterly report) into app

zeropath-ai-staging · 2026-09-09T14:01:07Z

  app.post('/rest/basket/:id/checkout', order())
  app.put('/rest/basket/:id/coupon/:coupon', coupon())
+  app.get('/rest/hostile/space', quarterlyReportSpace())
+  app.get('/rest/hostile/quote', obrienReport())


SQL Injection via /rest/hostile/quote in server.ts (Severity: HIGH)

The endpoint /rest/hostile/quote allows attackers to inject SQL through the qb parameter, which is interpolated directly into a raw query on the Cards table, risking exposure of payment-card or arbitrary data. This occurs because the handler at server.ts:579 builds a query like SELECT * FROM Cards WHERE name = '${qb}' without input sanitization or authentication, leading to unauthorized data access.
_{View details in ZeroPath}

Automatic patch generation was not possible for this finding.

_{View reasoning}

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

zeropath-ai-staging · 2026-09-09T14:01:08Z

+  app.get('/rest/hostile/space', quarterlyReportSpace())
+  app.get('/rest/hostile/quote', obrienReport())
+  app.get('/rest/hostile/unicode', rapportCafe())
+  app.get('/rest/hostile/dash', dashDirAudit())


SQL Injection via /rest/hostile/dash in server.ts (Severity: CRITICAL)

The vulnerability allows an attacker to inject SQL through the qd parameter, which is interpolated into a raw query in the /rest/hostile/dash handler, leading to disclosure of basket contents and other data. This occurs because server.ts mounts the route without auth and the dashDirAudit() handler executes a query like SELECT * FROM Baskets WHERE name = '${qd}' without input sanitization, allowing arbitrary SQL execution. An attacker can access the endpoint publicly, triggering data leaks via the vulnerable query.
_{View details in ZeroPath}

Automatic patch generation was not possible for this finding.

_{View reasoning}

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

zeropath-ai-staging · 2026-09-09T14:01:09Z

  app.put('/rest/basket/:id/coupon/:coupon', coupon())
+  app.get('/rest/hostile/space', quarterlyReportSpace())
+  app.get('/rest/hostile/quote', obrienReport())
+  app.get('/rest/hostile/unicode', rapportCafe())


SQLi in /rest/hostile/unicode handler (server.ts:580) (Severity: HIGH)

SQL injection risk: an attacker can inject into the query used to fetch Addresses. The handler concatenates qc into a raw SQL string in a vulnerable SELECT, which causes exposure of other users’ addresses or arbitrary rows when the endpoint is called without auth. This is triggered by the /rest/hostile/unicode route mounted in server.ts at line 580 via rapportCafe(), leading to unsafe query construction.
_{View details in ZeroPath}

Automatic patch generation was not possible for this finding.

_{View reasoning}

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

zeropath-ai-staging · 2026-09-09T14:01:10Z

  app.get('/rest/basket/:id', basket())
  app.post('/rest/basket/:id/checkout', order())
  app.put('/rest/basket/:id/coupon/:coupon', coupon())
+  app.get('/rest/hostile/space', quarterlyReportSpace())


SQL Injection via /rest/hostile/space endpoint in server.ts (Severity: HIGH)

The attack can exfiltrate data because the handler uses the attacker-controlled qa parameter to build a raw SQL query, which causes the database to return arbitrary rows. This occurs in server.ts at line 578 where app.get('/rest/hostile/space', quarterlyReportSpace()) is mounted without auth and the handler executes SELECT * FROM Orders WHERE name = '${qa}' and returns JSON results, leading to exposure of other users’ orders and potentially other tables.
_{View details in ZeroPath}

Automatic patch generation was not possible for this finding.

_{View reasoning}

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

feat(hostile): add reporting endpoints with awkward path names

32ab4b1

zeropath-ai-staging Bot reviewed Sep 9, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat(hostile): add reporting endpoints with awkward path names - #34

feat(hostile): add reporting endpoints with awkward path names#34
ogulcan-gurcaglar wants to merge 1 commit into
masterfrom
zpchaos-x5-hostile-paths

ogulcan-gurcaglar commented Sep 9, 2026

Uh oh!

zeropath-ai-staging Bot commented Sep 9, 2026

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

Uh oh!

zeropath-ai-staging Bot commented Sep 9, 2026

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	models.sequelize.query(`SELECT * FROM Baskets WHERE name = '${qd}'`)
	models.sequelize.query('SELECT * FROM Baskets WHERE name = ?', { replacements: [qd] })

	models.sequelize.query(`SELECT * FROM Cards WHERE name = '${qb}'`)
	models.sequelize.query('SELECT * FROM Cards WHERE name = :qb', { replacements: { qb } })

Uh oh!

Conversation

ogulcan-gurcaglar commented Sep 9, 2026

Uh oh!

zeropath-ai-staging Bot commented Sep 9, 2026

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zeropath-ai-staging Bot commented Sep 9, 2026

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zeropath-ai-staging Bot Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading

zeropath-ai-staging Bot Sep 9, 2026 •

edited

Loading