User reads another user's invoice

Code reviewSecurityMid–Senior~18 min

Review this Go handler that returns an invoice.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 18 min

Mark a line and say what kind of problem it is.0 findings

1func GetInvoice(w http.ResponseWriter, r *http.Request) {

2 userID := authFromContext(r.Context()) // authenticated user

3 invoiceID := r.URL.Query().Get("id")

4 var inv Invoice

5 err := db.QueryRow(

6 "SELECT id, customer_id, amount, pdf_url FROM invoices WHERE id = $1",

7 invoiceID,

8 ).Scan(&inv.ID, &inv.CustomerID, &inv.Amount, &inv.PDFURL)

9 if err != nil {

10 http.Error(w, "not found", 404)

11 return

12 }

13 json.NewEncoder(w).Encode(inv)

14 _ = userID

15}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.