Ran this on our auth module and found an IDOR I'd have shipped

## Security Audit — `getUserFile()` Three findings. The first is exploitable in under a minute. | CWE | Severity | Issue | |-----|----------|-------| | CWE-22 | **Critical** | Path traversal: `../../etc/passwd` escapes the upload dir | | CWE-639 | **High** | IDOR: no ownership check — any user reads any `fileId` | | CWE-532 | Low | Full file path logged on error (info leak) | **Exploit:** `GET /files/..%2f..%2f..%2fetc%2fpasswd` returns the host's password file. **Hardened version:** ```typescript import { resolve, normalize, sep } from "node:path"; const UPLOAD_ROOT = resolve("/var/app/uploads"); export async function getUserFile(userId: string, fileId: string) { // 1. Authorize ownership BEFORE touching disk const file = await db.query.files.findFirst({ where: and(eq(files.id, fileId), eq(files.ownerId, userId)), }); if (!file) throw new ForbiddenError(); // same error for "missing" and "not yours" // 2. Resolve + confine to the upload root const abs = normalize(resolve(UPLOAD_ROOT, file.storedName)); if (!abs.startsWith(UPLOAD_ROOT + sep)) throw new ForbiddenError(); return fs.readFile(abs); } ``` The ownership query kills the IDOR; the `startsWith(root + sep)` check kills traversal even if a stored name is malicious. Returning identical errors prevents enumeration.