Potential IDOR - Generic Data Access

Description

Detects endpoints where route parameters flow to generic data access patterns (Map.get, object property access, cache lookups, custom repositories) without visible ownership verification in the function. This rule catches patterns that ORM-specific detection misses, but requires human verification that authorization is not enforced elsewhere (middleware, decorators, API gateway, etc.). **This is a "potential" finding - verify authorization exists somewhere.**

How to fix

Verify ownership before returning data by checking resource belongs to authenticated user.

```javascript
const order = orders.get(req.params.id);
if (order.userId !== req.user.id) {
  return res.status(403).json({ error: 'Forbidden' });
}
```

Learn more: https://shoulder.dev/learn/javascript/cwe-639/idor-generic

Applies to

References

Scan for this issue

Related rules