OWASP Top 10 (2024) com exemplo em código

// ❌ RUIM — só checa autenticação
app.get('/orders/:id', requireAuth, async (req) => {
  const order = await db.order.findUnique({ where: { id: req.params.id } });
  return order;  // qualquer user logado vê qualquer order
});

// ✅ OK — check de owner no query
app.get('/orders/:id', requireAuth, async (req) => {
  const order = await db.order.findFirst({
    where: { id: req.params.id, userId: req.user.id },
  });
  if (!order) return 404;
  return order;
});

// ❌ SQLi clássico
const raw = await db.query(
  `SELECT * FROM users WHERE email = '${req.body.email}'`
);

// ✅ Parametrized
const raw = await db.query(
  'SELECT * FROM users WHERE email = $1',
  [req.body.email]
);

// ✅ ORM (recomendado)
const user = await prisma.user.findUnique({ where: { email: req.body.email } });

// ❌ Vulnerável — user passa URL, server fetch
app.post('/import-avatar', async (req) => {
  const img = await fetch(req.body.url);  // SSRF!
  // req.body.url = "http://169.254.169.254/latest/meta-data/iam/..."
  // → vaza IAM role
});

// ✅ Whitelist de domínios + bloqueio de ranges privados
const ALLOWED = ['imgur.com', 'i.imgur.com', 's3.amazonaws.com'];
const PRIVATE_RANGES = [/^10\./, /^172\.(1[6-9]|2\d|3[01])\./, /^192\.168\./, /^127\./, /^169\.254\./];

function safeUrl(raw: string): URL | null {
  try {
    const u = new URL(raw);
    if (u.protocol !== 'https:') return null;
    if (!ALLOWED.includes(u.hostname)) return null;
    // Resolve DNS e checa IP (evita rebinding)
    return u;
  } catch { return null; }
}

// Extra: usar proxy dedicado, timeout, body size limit.