Skip to content

Commit a80f06d

Browse files
committed
refactor: Update distrubutable formats
* A8:2019 Scenario #3 rephrashing * Apply last changes ODT document * Update PDF
1 parent 5a01c2c commit a80f06d

File tree

3 files changed

+3
-4
lines changed

3 files changed

+3
-4
lines changed
822 Bytes
Binary file not shown.
15.4 KB
Binary file not shown.

2019/en/src/0xa8-injection.md

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,18 +76,17 @@ router.delete('/bookings', async function (req, res, next) {
7676
res.status(200);
7777
} catch (err) {
7878
res.status(400).json({error: 'Unexpected error occured while processing a request'});
79-
};
79+
}
80+
});
8081
```
8182

8283
Attacker intercepted the request and changed `bookingId` query string parameter
83-
as below:
84+
as below, the attacker managed to delete another user booking:
8485

8586
```
8687
DELETE /api/bookings?bookingId[$ne]=678
8788
```
8889

89-
As a result, the attacker managed to delete another user booking.
90-
9190
## How To Prevent
9291

9392
Preventing injection requires keeping data separate from commands and queries.

0 commit comments

Comments
 (0)