My open-source experience

说明与用途

作者在 BookCars 项目中发现了授权缺陷，供应商可以更改其他供应商的预订状态，并记录了此问题，强调在报告前需要彻底调查。

问题

A supplier could change another supplier's booking status in BookCars because the updateStatus() endpoint does not verify booking ownership.

结果

The author discovered an authorization flaw in BookCars, documented it, and reflected on the importance of thorough investigation before reporting.

工作流

• 1. Reviewed the updateStatus() endpoint and its authentication middleware. 2. Compared it with deleteBookings() to find missing ownership check. 3. Used AI to guide code exploration but verified findings manually. 4. Created a GitHub issue documenting the vulnerability.
• 5. Planned to add a minimal reproduction or regression test in future work.

证据

I focused on the updateStatus() endpoint, where a supplier can update booking statuses after passing authentication and the supplier-role check. While tracing the code, I noticed that the endpoint looks up bookings only by their IDs and does not verify that the booking actually belongs to the supplier making the request

来源

I used AI mainly as a second pair of eyes for code exploration and reasoning, rather than treating its answers as proof.

来源