codejump
MediumJavaScriptTypeScript

Fix Insecure Direct Object Reference (IDOR)

Node.jsSecurity

The function below returns every memo in the system, regardless of who is asking.

The bug: this is the real behavior of OWASP's NodeGoat (a deliberately-vulnerable Node.js app used for security training) — its memo-listing endpoint fetches all memos from the database and renders them, without ever filtering by the logged-in user. Any authenticated user can read every other user's private memos just by visiting the page.

Your task: fix solve(allMemos, currentUserId) so it returns only the memos that belong to currentUserId.

const memos = [
  { id: 1, userId: 'alice', text: 'Buy milk' },
  { id: 2, userId: 'bob', text: 'Call the bank' },
];
solve(memos, 'alice') // → [{ id: 1, userId: 'alice', text: 'Buy milk' }]

Sample tests

Test #1Returns only the requesting user's memo
Input: [[{"id":1,"text":"Buy milk","userId":"alice"},{"id":2,"text":"Call the bank","userId":"bob"}],"alice"]
Output: [{"id":1,"text":"Buy milk","userId":"alice"}]
Test #2Multiple memos belonging to the same user
Input: [[{"id":1,"text":"Buy milk","userId":"alice"},{"id":2,"text":"Call the bank","userId":"bob"},{"id":3,"text":"Book flight","userId":"alice"}],"alice"]
Output: [{"id":1,"text":"Buy milk","userId":"alice"},{"id":3,"text":"Book flight","userId":"alice"}]
Test #3User with no memos gets an empty list, not everyone else's
Input: [[{"id":1,"text":"Buy milk","userId":"alice"}],"carol"]
Output: []
← All challenges