Fix BFLA (Broken Function Level Authorization) in Cuba

BFLA is a critical logic flaw where an application fails to verify if a user has the appropriate privileges to access a specific function. In Cuba's minimalist routing environment, this usually manifests when developers assume that being 'logged in' is equivalent to being 'authorized' for administrative actions. To secure the stack, we must implement explicit authorization checks at the route level.

The Vulnerable Pattern

Cuba.define do
  on "api/v1/users/:id/delete" do |id|
    # VULNERABILITY: No check to see if the requester is an admin
    # Any authenticated user can hit this endpoint and delete others
    User[id].delete
    res.write "User deleted"
  end
end

The Secure Implementation

The fix involves implementing a 'Gatekeeper Pattern'. By defining an `ensure_admin!` helper that validates the session's role and calls `halt`, we prevent the execution of sensitive business logic for unauthorized actors. The secure implementation nests the sensitive function behind this check, moving from a 'permissive by default' stance to 'restrictive by default' for administrative functions.

def ensure_admin!
  unless session[:user_role] == 'admin'
    res.status = 403
    res.write 'Forbidden: Insufficient Permissions'
    halt(res.finish)
  end
end
Cuba.define do
on “api/v1” do
on “users/:id/delete” do |id|
ensure_admin!
User[id].delete
res.write “User deleted”
end
end
end