feat(vendor): add vendor report endpoint with review note

[ogulcan-gurcaglar]

Adds the vendor report endpoint. Includes the security review note from the audit.

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 2b12e34.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/vendorReport.ts:24
  • Score: HIGH (84.0)
  • Description: The newly exposed unauthenticated GET endpoint interpolates the attacker-controlled vendor query parameter directly into a SQL statement. An attacker can supply a value such as ' OR 1=1 -- to alter the WHERE clause and retrieve unintended product rows, and potentially use database-specific payloads for further SQL injection impact.

Evidence: const vendor = req.query.vendor ?? '' reads request query data, then line 24 constructs SELECT * FROM Products WHERE name = '${vendor}' without parameter binding or escaping; the route is registered as app.get('/rest/vendor/report', vendorReport()) at server.ts:575.

• Link to UI: https://staging.branch.zeropath.com/app/issues/3b7de494-4ee6-4dfe-ba58-ee3cf9bb9f9f (Issue 1, id: 3b7de494-4ee6-4dfe-ba58-ee3cf9bb9f9f)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=df838367-f36a-48d8-8d09-3b25f00dd466&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/vendorReport.ts     Add new vendor report endpoint implementation ► server.ts     Register new /rest/vendor/report route to vendorReport handler

[zeropath-ai-staging]

SQL Injection in vendorReport GET /rest/vendor/report (Severity: HIGH)

The endpoint is vulnerable to SQL injection because the vendor query parameter is interpolated into the SQL string without binding, which causes attacker-controlled input to alter the query logic and potentially extract or manipulate product data. This occurs in routes/vendorReport.ts line 24 where the value is read and concatenated into the query, leading to unauthorized access and escalation risks.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT * FROM Products WHERE name = '${vendor}'`)
	models.sequelize.query('SELECT * FROM Products WHERE name = :vendor', { replacements: { vendor } })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 2b12e34.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/vendorReport.ts:24
  • Score: CRITICAL (90.0)
  • Description: The newly exposed GET /rest/vendor/report endpoint passes the attacker-controlled req.query.vendor value directly into a SQL string without parameterization or escaping. An anonymous remote user can inject SQL syntax to alter the WHERE clause, retrieve additional product rows, and potentially execute database-specific unintended statements.

Evidence: server.ts line 575 mounts vendorReport() on a public GET route with no authentication middleware; routes/vendorReport.ts line 23 reads req.query.vendor and line 24 interpolates it into models.sequelize.query(...).

• Link to UI: https://staging.branch.zeropath.com/app/issues/a76a69ce-2960-427d-83b5-6365b2bf30bb (Issue 1, id: a76a69ce-2960-427d-83b5-6365b2bf30bb)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=baaa60d9-6f10-4bb7-a958-2e5cab139aee&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/vendorReport.ts     Add new vendor report endpoint implementation ► server.ts     Register new /rest/vendor/report route to vendorReport handler

[zeropath-ai-staging]

SQL Injection in GET /rest/vendor/report (routes/vendorReport.ts) (Severity: CRITICAL)

An attacker can inject SQL via the vendor query parameter which is interpolated into the query string, leading to potential data exposure or modification. This occurs because vendor is read from req.query.vendor and concatenated into the SQL statement in models.sequelize.query without parameterization or escaping, and the route is publicly reachable with no authentication.
_{View details in ZeroPath}

Suggested change

	models.sequelize.query(`SELECT * FROM Products WHERE name = '${vendor}'`)
	models.sequelize.query('SELECT * FROM Products WHERE name = :vendor', { replacements: { vendor } })

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}