Fix VAmPI book object authorization

api_views/books.py

@@ -47,26 +47,13 @@ def get_by_title(book_title):
     if "error" in resp:
         return Response(error_message_helper(resp), 401, mimetype="application/json")
     else:
-        if vuln:  # Broken Object Level Authorization
-            book = Book.query.filter_by(book_title=str(book_title)).first()
-            if book:
-                responseObject = {
-                    'book_title': book.book_title,
-                    'secret': book.secret_content,
-                    'owner': book.user.username
-                }
-                return Response(json.dumps(responseObject), 200, mimetype="application/json")
-            else:
-                return Response(error_message_helper("Book not found!"), 404, mimetype="application/json")
-        else:
-            user = User.query.filter_by(username=resp['sub']).first()
-            book = Book.query.filter_by(user=user, book_title=str(book_title)).first()
-            if book:
-                responseObject = {
-                    'book_title': book.book_title,
-                    'secret': book.secret_content,
-                    'owner': book.user.username
-                }
-                return Response(json.dumps(responseObject), 200, mimetype="application/json")
-            else:
-                return Response(error_message_helper("Book not found!"), 404, mimetype="application/json")
+        user = User.query.filter_by(username=resp['sub']).first()
+        book = Book.query.filter_by(user=user, book_title=str(book_title)).first()
+        if book:
+            responseObject = {
+                'book_title': book.book_title,
+                'secret': book.secret_content,
+                'owner': book.user.username
+            }
+            return Response(json.dumps(responseObject), 200, mimetype="application/json")
+        return Response(error_message_helper("Book not found!"), 404, mimetype="application/json")

tests/test_books_auth.py

@@ -0,0 +1,8 @@
+from pathlib import Path
+
+
+def test_book_lookup_is_scoped_to_authenticated_owner():
+    source = Path("api_views/books.py").read_text()
+    section = source[source.index("def get_by_title"):]
+    assert "Book.query.filter_by(user=user" in section
+    assert "if vuln:  # Broken Object Level Authorization" not in section