badAPI/badApi/loan.js at 94eee1170a2c06dd5bd5f64e4536ab232c39c786 · Commando-X/badAPI · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
const express = require('express');
const router = express.Router();

// In-memory database for loan applications
let loanApplications = [
  { username: 'user1', amount: 5000, status: 'pending' },
];

/**
 * @swagger
 * tags:
 *   name: Loan
 *   description: Loan-related endpoints
 */

/**
 * @swagger
 * /loan/apply:
 *   post:
 *     summary: Apply for a loan
 *     description: Submits a loan application, simulating a broken object-level authorization vulnerability where any user can apply for a loan.
 *     tags: [Loan]
 *     requestBody:
 *       required: true
 *       content:
 *         application/json:
 *           schema:
 *             type: object
 *             properties:
 *               username:
 *                 type: string
 *                 example: user1
 *               amount:
 *                 type: number
 *                 format: float
 *                 example: 1000
 *     responses:
 *       200:
 *         description: Loan application submitted successfully
 *         content:
 *           application/json:
 *             schema:
 *               type: object
 *               properties:
 *                 message:
 *                   type: string
 *                   example: Loan application submitted
 *                 newLoan:
 *                   type: object
 *                   properties:
 *                     username:
 *                       type: string
 *                       example: user1
 *                     amount:
 *                       type: number
 *                       format: float
 *                       example: 1000
 *                     status:
 *                       type: string
 *                       example: pending
 *       400:
 *         description: Bad request, likely due to missing or invalid data
 *         content:
 *           application/json:
 *             schema:
 *               type: object
 *               properties:
 *                 message:
 *                   type: string
 *                   example: Bad request
 */

router.post('/apply', (req, res) => {
  const { username, amount } = req.body;

  // Simulate a loan application
  const newLoan = { username, amount, status: 'pending' };
  loanApplications.push(newLoan);

  return res.json({ message: 'Loan application submitted', newLoan });
});

module.exports = router;