codejump
MediumPython

Fix Insecure Direct Object Reference (IDOR)

PythonSecurity

The function below returns every memo in the system, regardless of who is asking.

The bug: this is the same class of bug as OWASP's NodeGoat's memo-listing endpoint (a deliberately-vulnerable app used for security training) — it fetches all memos and renders them, without ever filtering by the logged-in user. Any authenticated user can read every other user's private memos just by visiting the page.

Your task: fix solve(all_memos, current_user_id) so it returns only the memos that belong to current_user_id.

memos = [
    {'id': 1, 'user_id': 'alice', 'text': 'Buy milk'},
    {'id': 2, 'user_id': 'bob', 'text': 'Call the bank'},
]
solve(memos, 'alice')  # → [{'id': 1, 'user_id': 'alice', 'text': 'Buy milk'}]

Sample tests

Test #1Returns only the requesting user's memo
Input: [[{"id":1,"text":"Buy milk","user_id":"alice"},{"id":2,"text":"Call the bank","user_id":"bob"}],"alice"]
Output: [{"id":1,"text":"Buy milk","user_id":"alice"}]
Test #2Multiple memos belonging to the same user
Input: [[{"id":1,"text":"Buy milk","user_id":"alice"},{"id":2,"text":"Call the bank","user_id":"bob"},{"id":3,"text":"Book flight","user_id":"alice"}],"alice"]
Output: [{"id":1,"text":"Buy milk","user_id":"alice"},{"id":3,"text":"Book flight","user_id":"alice"}]
Test #3User with no memos gets an empty list, not everyone else's
Input: [[{"id":1,"text":"Buy milk","user_id":"alice"}],"carol"]
Output: []
← All challenges