The endpoint /api/papers/{paper_id}/save is vulnerable to Broken Access Control (IDOR) because it accepts a user_id in the request body without verification. This allows an attacker to save papers to any user's library, leading to unauthorized modification of user data. Additionally, there's an inconsistency where paper_id is an integer in the path but expected as a string in SqlAlchemyResearchStore, which could lead to confusion if paper_id can also be a Semantic Scholar ID. Ensure the user_id in the request matches the authenticated requester's identity and clarify the paper_id type handling.
Originally posted by @gemini-code-assist[bot] in #27 (comment)
The endpoint
/api/papers/{paper_id}/saveis vulnerable to Broken Access Control (IDOR) because it accepts auser_idin the request body without verification. This allows an attacker to save papers to any user's library, leading to unauthorized modification of user data. Additionally, there's an inconsistency wherepaper_idis an integer in the path but expected as a string inSqlAlchemyResearchStore, which could lead to confusion ifpaper_idcan also be a Semantic Scholar ID. Ensure theuser_idin the request matches the authenticated requester's identity and clarify thepaper_idtype handling.Originally posted by @gemini-code-assist[bot] in #27 (comment)