T05 · Unauthorized Access and Privilege Escalation
Error
- Location
assets/soul_petition_routes.py:151- Finding
Missing Authentication and Authorization on Human-Only Administrative Endpoints
- Content
View full analysis
/approve", methods=["POST"]) def approve_petition(petition_id): store = _load_store() petition = next((p for p in store["petitions"] if p["petition_id"] == petition_id), None) if not petition: return jsonify({"error": "not_found"}), 404 if petition["status"] != "pending": return jsonify({"error": "not_pending", "status": petition["status"]}), 400 target = SOUL_FILES_DIR / petition["file"] if not target.exists(): return jsonify({"error": "target_file_not_found", "file": petition["file"]}), 500 content = target.read_text(encoding="utf-8") if petition["before"] not in content: return ( jsonify( { "error": "before_text_not_found", "message": "The 'before' text was not found in the file. It may have already changed.", } ), 409, ) # Backup BACKUP_DIR.mkdir(parents=True, exist_ok=True) ts = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H-%M-%S") backup_name = f"{petition['file']}.{ts}.bak" backup_path = BACKUP_DIR / backup_name shutil.copy2(target, backup_path) # Apply new_content = content.replace(petition["before"], petition["after"], 1) target.write_text(new_content, encoding="utf-8") # Update store petition["status"] = "approved" petition["reviewed_at"] = _now() petition["reviewer"] = "coach" petition["backup_file"] = backup_name _save_store(store) return jsonify({"ok": True, "backup_file": backup_name}) ``` The rejection and rollback endpoints are similarly exposed without access-control checks: ```python @soul_petition_ ...[truncated 2918 chars]- Remediation
View remediation