From 46a66e8c84add325ef2b3fa1263d251d3de9ef0c Mon Sep 17 00:00:00 2001
From: snow <snow@snows-MacBook-Pro-2.local>
Date: Mon, 10 Aug 2026 00:20:03 -0700
Subject: [PATCH] Ignore IDOR level 3 role cookie

Signed-off-by: snow <snow@snows-MacBook-Pro-2.local>
---
 .../service/vulnerability/idor/IDORVulnerability.java        | 2 +-
 .../service/vulnerability/idor/IDORVulnerabilityTest.java    | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java
index d23f59e2e..35f48a613 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java
@@ -155,7 +155,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level3(
             if (actualToken != null) {
                 User decodedUser = idorLoginService.decodeToken(actualToken);
                 int tokenUserId = decodedUser.getUserId();
-                String role = cookieRole != null ? cookieRole : decodedUser.getRole();
+                String role = decodedUser.getRole();
 
                 if (id == null) {
                     id = tokenUserId;
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java
index 12b3b1cbd..d7f786013 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java
@@ -76,7 +76,7 @@ void level2_ShouldAllowCookieTampering() {
     }
 
     @Test
-    void level3_ShouldAllowRoleEscalationWhenRoleCookieIsAdmin() {
+    void level3_ShouldRejectRoleEscalationWhenRoleCookieIsAdmin() {
         String fakeToken =
                 java.util.Base64.getEncoder()
                         .encodeToString("{\"userId\":2,\"role\":\"USER\"}".getBytes());
@@ -96,7 +96,8 @@ void level3_ShouldAllowRoleEscalationWhenRoleCookieIsAdmin() {
         ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
                 idor.level3(fakeToken, "ADMIN", 3);
 
-        assertTrue(response.getBody().getIsValid());
+        assertFalse(response.getBody().getIsValid());
+        assertEquals("Access Denied - Insufficient privileges", response.getBody().getContent());
     }
 
     @Test