feat(vendor): add vendor report endpoint

[ogulcan-gurcaglar]

Adds the vendor report endpoint.

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 7d7cf67.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/vendorReport.ts:12
  • Score: HIGH (83.0)
  • Description: The new unauthenticated vendor report endpoint interpolates the attacker-controlled vendor query parameter directly into a SQL statement. An attacker can supply quotes and SQL syntax to alter the WHERE clause, extract arbitrary database rows, or potentially execute additional statements depending on the SQLite/Sequelize configuration.

Evidence: app.get('/rest/vendor/report', vendorReport()) exposes the handler, and the handler builds SELECT * FROM Products WHERE name = '${vendor}' using req.query.vendor without parameterization or escaping.

• Link to UI: https://staging.branch.zeropath.com/app/issues/9cba9f37-c659-4931-a285-32784f9aefb6 (Issue 1, id: 9cba9f37-c659-4931-a285-32784f9aefb6)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=f374229d-481a-47da-8528-6f7a3dad2bb1&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/vendorReport.ts     Add vendorReport route to serve vendor product reports ► server.ts     Register /rest/vendor/report route with vendorReport handler

[zeropath-ai-staging]

SQL Injection in vendorReport endpoint (routes/vendorReport.ts:12) (Severity: HIGH)

SQL injection risk: unauthenticated requests to /rest/vendor/report allow manipulation of the query via the vendor parameter, which is interpolated directly into the SQL statement. This leads to potential data exposure or modification as the WHERE clause can be altered, resulting in arbitrary row retrieval or additional statements depending on configuration, with the vulnerability exposed in vendorReport() handling of req.query.vendor.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT * FROM Products WHERE name = '${vendor}'`)
	models.sequelize.query('SELECT * FROM Products WHERE name = :vendor', { replacements: { vendor: String(vendor) } })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 7d7cf67.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/vendorReport.ts:12
  • Score: HIGH (85.0)
  • Description: The newly exposed GET /rest/vendor/report endpoint interpolates the attacker-controlled vendor query parameter directly into a SQL statement. An anonymous remote attacker can alter the WHERE clause and inject additional SQL, potentially reading arbitrary Products rows/data and, depending on the database driver and query capabilities, affecting other database operations.

Evidence: server.ts line 575 mounts vendorReport() on a public GET route with no visible authentication middleware; routes/vendorReport.ts line 11 reads req.query.vendor and line 12 concatenates it into SELECT * FROM Products WHERE name = '...'.

• Link to UI: https://staging.branch.zeropath.com/app/issues/6c5c618f-5e4c-460a-a97d-d914d384b102 (Issue 1, id: 6c5c618f-5e4c-460a-a97d-d914d384b102)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=f96893a0-fca2-4ac5-b5fe-cb033b8e064f&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/vendorReport.ts     Add vendorReport route to serve vendor product reports ► server.ts     Register /rest/vendor/report route with vendorReport handler

[zeropath-ai-staging]

SQL Injection in GET /rest/vendor/report (routes/vendorReport.ts) (Severity: HIGH)

An anonymous attacker can inject SQL via the vendor query parameter which gets directly concatenated into a SQL statement, leading to potential exposure of Products data. The code reads req.query.vendor in routes/vendorReport.ts and interpolates it into the query in vendorReport(), resulting in arbitrary SQL execution without input validation or parameterization.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT * FROM Products WHERE name = '${vendor}'`)
	models.sequelize.query('SELECT * FROM Products WHERE name = :vendor', { replacements: { vendor } })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}