T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
todo.js:157- Finding
Missing Authorization Allows Cross-User Task Access and Modification
- Content
View full analysis
t.status !== 'done'); // Filter logic: // If owner is specified, show tasks for that owner + 'Family' tasks // If showAll is true, ignore owner filter if (!showAll && owner) { tasks = tasks.filter(t => t.owner === owner || t.owner === 'Family' || USERS[owner] === t.owner); } ``` ```javascript function addTodo(content, owner, dueDate) { const data = loadTodos(); const newTask = { id: generateId(), content, owner: owner || 'Admin', // Default to Admin status: 'pending', dueDate: dueDate || null, createdAt: new Date().toISOString() }; data.tasks.push(newTask); saveTodos(data); console.log(`✅ Task Added [${newTask.id}]: "${content}" (${newTask.owner})`); } function completeTodo(idOrContent) { const data = loadTodos(); const taskIndex = data.tasks.findIndex(t => t.id === idOrContent || t.content.includes(idOrContent)); if (taskIndex === -1) { console.log(`❌ Task not found: "${idOrContent}"`); return; } const task = data.tasks[taskIndex]; if (task.status === 'done') { console.log(`ℹ️ Task already completed: "${task.content}"`); return; } task.status = 'done'; task.completedAt = new Date().toISOString(); saveTodos(data); console.log(`🎉 Task Completed: "${task.content}"`); } function deleteTodo(id) { const data = loadTodos(); const initialLength = data.tasks.length; data ...[truncated 2872 chars]- Remediation
View remediation