Skip to content

TCE-1285 Support IDOR vulnerabilities #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DMarinhoCodacy wants to merge 1 commit into
base: main
Choose a base branch
from
Open

TCE-1285 Support IDOR vulnerabilities #31

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
206 changes: 205 additions & 1 deletion docs/codacy-rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -625,4 +625,208 @@ rules:
impact: HIGH
confidence: HIGH
references:
- https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/
- https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/
- id: codacy.javascript.security.idor-express-direct-lookup
severity: ERROR
languages:
- javascript
- typescript
patterns:
- pattern-either:
- pattern: |
$APP.$METHOD('$ROUTE/:$ID', ($REQ, $RES) => {
...
$DB.findById($REQ.params.$ID)
...
})
- pattern: |
$ROUTER.$METHOD('$ROUTE/:$ID', ($REQ, $RES) => {
...
$DB.findById($REQ.params.$ID)
...
})
- pattern: |
$APP.$METHOD('$ROUTE/:$ID', ($REQ, $RES) => {
...
$DB.$QUERY({...id: $REQ.params.$ID...})
...
})
- pattern: |
$APP.$METHOD('$ROUTE/:$ID', ($REQ, $RES) => {
...
$DB.$QUERY($REQ.params.$ID)
...
})
message: >
Potential IDOR vulnerability detected: User-controlled ID from request parameters is used directly to fetch resources
without authorization checks. Always verify that the authenticated user owns or has permission to access the requested resource
before returning data.
metadata:
owasp:
- A1:2021 Broken Access Control
cwe:
- CWE-639
description: Direct use of request parameters in database queries without authorization checks
category: security
technology:
- javascript
- express
- nodejs
impact: HIGH
confidence: MEDIUM
- id: codacy.java.security.idor-spring-direct-repository
severity: ERROR
languages:
- java
patterns:
- pattern-either:
- pattern: |
@$MAPPING("$PATH/{$ID}")

@codacy-production codacy-production Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

Suggestion: The Spring mapping pattern '$PATH/{$ID}' does not account for URI templates with regex constraints (e.g., '{id:[0-9]+}'). Adding patterns that support these variations will improve the rule's effectiveness in real-world Spring applications.

public $RETURN $METHOD(@PathVariable $TYPE $ID, ...) {
...
$REPO.findById($ID)
...
}
- pattern: |
@$MAPPING("$PATH/{$ID}")
public $RETURN $METHOD(@PathVariable $TYPE $ID, ...) {
...
$REPO.$QUERY($ID)
...
}
- pattern: |
@$MAPPING("$PATH/{$ID}")
public $RETURN $METHOD(@PathVariable $TYPE $ID, ...) {
...
$QUERY.setParameter("$PARAM", $ID)

@codacy-production codacy-production Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

The pattern uses a literal string "$PARAM", which will only match code that literally contains that text. To match any parameter name, use the metavariable without quotes:

Suggested change
$QUERY.setParameter("$PARAM", $ID)
$QUERY.setParameter($PARAM, $ID)

...
}
- metavariable-regex:
metavariable: "$MAPPING"
regex: "(GetMapping|PostMapping|PutMapping|DeleteMapping|RequestMapping)"
message: >
Potential IDOR vulnerability detected: @PathVariable is used directly in repository queries without authorization checks.
Ensure the authenticated user owns or has permission to access the resource before performing operations.
metadata:
owasp:
- A1:2021 Broken Access Control
cwe:
- CWE-639
description: Direct use of @PathVariable in repository queries without authorization checks
category: security
technology:
- java
- spring
- jpa
impact: HIGH
confidence: MEDIUM
- id: codacy.python.security.idor-flask-direct-query
severity: ERROR
languages:
- python
patterns:
- pattern-either:
- pattern: |
@$APP.route('$ROUTE/<$ID>')

@codacy-production codacy-production Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

Suggestion: The Flask route pattern '$ROUTE/<$ID>' only matches parameters without type converters. Flask routes frequently use converters like 'int:id' or 'uuid:id'. Consider adding patterns to cover these typed parameters to ensure user-controlled endpoints are correctly monitored.

def $FUNC($ID):
...
$DB.session.query(...).filter_by(id=$ID)...
...
- pattern: |
@$APP.route('$ROUTE/<$ID>')
def $FUNC($ID):
...
$MODEL.query.get($ID)
...
- pattern: |
@$APP.route('$ROUTE/<$ID>')
def $FUNC($ID):
...
$DB.get($ID)
...
message: >
Potential IDOR vulnerability detected: Route parameter is used directly in database queries without authorization checks.
Always verify that the authenticated user owns or has permission to access the requested resource.
metadata:
owasp:
- A1:2021 Broken Access Control
cwe:
- CWE-639
description: Direct use of URL parameters in database queries without authorization checks
category: security
technology:
- python
- flask
- sqlalchemy
impact: HIGH
confidence: MEDIUM
- id: codacy.php.security.idor-direct-query
severity: ERROR
languages:
- php
patterns:
- pattern-either:
- pattern: |
$DB->query("... WHERE id = " . $_GET['$ID'] ...)
- pattern: |
$DB->query("... WHERE id = " . $_POST['$ID'] ...)
- pattern: |
Comment on lines +770 to +773

@codacy-production codacy-production Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

The PHP patterns contain several logic errors and metadata gaps. Array keys (e.g., $_GET['$ID']) are using literal string quotes instead of metavariables, and the select pattern is overly restrictive regarding assignments. Additionally, while these detect IDOR risks, the use of string concatenation with user input is primarily a SQL Injection (CWE-89) vulnerability; consider adding CWE-89 to the metadata.

$DB->prepare("... WHERE id = ?")->execute([$_GET['$ID']])
- pattern: |
$DB->prepare("... WHERE id = ?")->execute([$_POST['$ID']])
- pattern: |
select($WHERE = $_GET['$ID'])
- pattern: |
select($WHERE = $_POST['$ID'])
message: >
Potential IDOR vulnerability detected: User input from $_GET or $_POST is used directly in database queries.
Verify that the authenticated user owns or has permission to access the resource before executing the query.
metadata:
owasp:
- A1:2021 Broken Access Control
cwe:
- CWE-639
description: Direct use of $_GET/$_POST in database queries without authorization checks
category: security
technology:
- php
impact: HIGH
confidence: MEDIUM
- id: codacy.generic.security.idor-missing-auth-check
severity: WARNING
languages:
- javascript
- typescript
- java
- python
- php
- csharp
patterns:
- pattern-either:
- pattern: |
$USER_ID = $REQUEST.$PARAM
...
return $DB.$QUERY($USER_ID)
- pattern: |
$ID = $REQUEST.$PARAM
...
return $RESOURCE.$QUERY($ID)
- pattern: |
function $FUNC($ID) {
...
return $DB.get($ID)
}
Comment on lines +815 to +818

@codacy-production codacy-production Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

Suggestion: This generic pattern is overly broad and likely to produce significant false positives. It flags any function that retrieves a resource by ID and returns it, regardless of whether authorization checks are performed earlier in the function body or if it is a legitimate service layer call. Consider refining the rule to focus only on identifiers explicitly sourced from request objects to reduce noise.

message: >
Potential IDOR vulnerability: User-supplied parameter used directly to access resources.
Ensure proper authorization checks are performed to validate the user has access to the requested resource.
metadata:
owasp:
- A1:2021 Broken Access Control
cwe:
- CWE-639
description: Generic pattern detecting direct resource access without authorization
category: security
technology:
- web
impact: HIGH
confidence: LOW