id: JS-SEC-029
name: idor-pattern
severity: medium
language: javascript
cwe: CWE-639
owasp: "A01:2021"
description: "Detect potential IDOR where user-supplied IDs are used directly in database lookups."
pattern:
  type: regex
  regex:
    - 'findById\s*\(\s*req\.(params|query|body)'
    - 'findByPk\s*\(\s*req\.(params|query|body)'
    - '\.findOne\s*\(\s*\{.*_id\s*:\s*req\.(params|query|body)'
message: "Possible IDOR vulnerability. User-supplied identifiers used directly in database queries without authorization checks."
fix_hint: "Always verify object ownership. Check that the authenticated user has permission to access the requested resource."
references:
  - https://cwe.mitre.org/data/definitions/639.html
  - https://owasp.org/Top10/A01_2021-Broken_Access_Control/
