Fix Challenge-8-IDOR-Bank: bind bank balance/transfer to the session's own account

src/main/java/servlets/module/challenge/DirectObjectBankCurrentBalance.java

@@ -69,6 +69,18 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
       try {
         String accountNumber = request.getParameter("accountNumber");
         log.debug("Account Number - " + accountNumber);
+        Object boundAccount = ses.getAttribute("directObjectBankAccount");
+        if (boundAccount == null || !boundAccount.toString().equals(accountNumber)) {
+          log.warn(
+              levelName
+                  + " - Rejected balance lookup for account "
+                  + accountNumber
+                  + " requested by session bound to "
+                  + boundAccount
+                  + ". This is not their account.");
+          out.write(errors.getString("error.shouldNotBeHere"));
+          return;
+        }
         String applicationRoot = getServletContext().getRealPath("");
         String htmlOutput = new String();
         long currentBalance =

src/main/java/servlets/module/challenge/DirectObjectBankTransfer.java

@@ -81,9 +81,22 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
         log.debug("Transfer Amount - " + transferAmountString);
         float tranferAmount = Float.parseFloat(transferAmountString);
 
+        Object boundAccount = ses.getAttribute("directObjectBankAccount");
+
         // Data Validation
-        // Positive Transfer Amount?
-        if (tranferAmount > 0) {
+        // Sender Account must be the account the session is actually signed in to. Funds may
+        // only ever be moved out of the account that was authenticated with, never an
+        // arbitrary account number supplied by the client.
+        if (boundAccount == null || !boundAccount.toString().equals(senderAccountNumber)) {
+          log.warn(
+              levelName
+                  + " - Rejected transfer attempt out of account "
+                  + senderAccountNumber
+                  + " by session bound to "
+                  + boundAccount
+                  + ". This is not their account.");
+          errorMessage = errors.getString("error.shouldNotBeHere");
+        } else if (tranferAmount > 0) {
           // Sender Account Has necessary funds?
           long senderFunds =
               DirectObjectBankLogin.getAccountBalance(senderAccountNumber, applicationRoot);