Bug Description
POST /api/users and POST /api/proposals forward request bodies into services that construct records as { id: generated, ...payload }. Because caller payload fields are spread last, a client can provide an id field and override the server-generated user or proposal id.
Expected Behavior
User and proposal ids should be server-owned. Client-controlled id values should be ignored so callers cannot create records with arbitrary, duplicate, or misleading identifiers.
Reproduction
- Start the API.
- Send
POST /api/users with { "id": "usr_attacker_controlled", "name": "Example User", "email": "user@example.com" }.
- Send
POST /api/proposals with { "id": "prp_attacker_controlled", "jobId": "job_123", "freelancerId": "usr_123", "coverLetter": "I can complete this job." }.
- Observe that the responses can return caller-supplied ids instead of generated ids.
Proposed Fix
- Assign generated user and proposal ids after spreading caller payload fields.
- Add regression tests proving caller-controlled user/proposal ids are ignored.
- Include a short demo video showing the focused tests and diff proof.
Parent bounty: #743
This issue is limited only to the creator of this issue. This means that only the issue author can attempt to solve this issue. If you would like to work on it, please create another issue with the same contents and refer to issue #743 for more information.
Bug Description
POST /api/usersandPOST /api/proposalsforward request bodies into services that construct records as{ id: generated, ...payload }. Because caller payload fields are spread last, a client can provide anidfield and override the server-generated user or proposal id.Expected Behavior
User and proposal ids should be server-owned. Client-controlled
idvalues should be ignored so callers cannot create records with arbitrary, duplicate, or misleading identifiers.Reproduction
POST /api/userswith{ "id": "usr_attacker_controlled", "name": "Example User", "email": "user@example.com" }.POST /api/proposalswith{ "id": "prp_attacker_controlled", "jobId": "job_123", "freelancerId": "usr_123", "coverLetter": "I can complete this job." }.Proposed Fix
Parent bounty: #743
This issue is limited only to the creator of this issue. This means that only the issue author can attempt to solve this issue. If you would like to work on it, please create another issue with the same contents and refer to issue #743 for more information.