Fix Business Logic Errors in Cuba

Cuba is a micro-framework that offers zero hand-holding. Business logic errors, specifically Insecure Direct Object References (IDOR), are rampant when developers assume that knowing a resource ID implies authorization. In a hacker's eyes, an unvalidated ID in a route is an invitation to manipulate state across the entire database.

The Vulnerable Pattern

Cuba.define do
  on "api/v1/profile/:id/update" do |id|
    on post do
      # VULNERABILITY: Directly trusting the ID from the URL
      user = User[id]
      user.update(req.params["user"])
      res.write "Profile updated"
    end
  end
end

The Secure Implementation

The vulnerable snippet allows any authenticated (or even unauthenticated) user to modify any profile by simply changing the ID in the URI. The secure implementation enforces a server-side check that compares the resource owner's ID with the 'user_id' stored in the encrypted session. As a Senior AppSec rule: Never map user input directly to database write operations without a scope-based lookup or an explicit ownership verification layer.

Cuba.define do
  on "api/v1/profile/:id/update" do |id|
    on post do
      # FIX: Validate that the session user matches the resource owner
      user = User[id]
      if user && session[:user_id] == user.id
        user.update(req.params["user"])
        res.write "Profile updated"
      else
        res.status = 403
        res.write "Unauthorized Access Attempt Logged"
      end
    end
  end
end