Commnet

This is an IDOR vulnerability as it allows for message access of any other user.

Fix

The function requires Auth but fails to implement any checks whatsoever which leads to IDOR.

The fix would be actually checking the userId:

router.get('/:id', requireAuth, (req, res) => {
  const messageId = req.params.id;
  const userId = req.session.userId;

  req.db.get(`
    SELECT m.*, 
           sender.username as sender_username, 
           sender.enclave as sender_enclave,
           recipient.username as recipient_username,
           recipient.enclave as recipient_enclave
    FROM messages m
    LEFT JOIN users sender ON m.sender_id = sender.id
    LEFT JOIN users recipient ON m.recipient_id = recipient.id
    WHERE m.id = ? AND (m.sender_id = ? OR m.recipient_id = ?)
  `, [messageId, userId, userId], (err, message) => {
    if (err) {
      console.error('Database error:', err);
      return res.status(500).json({ success: false, error: 'Internal server error' });
    }
    
    if (!message) {
      return res.status(404).json({ success: false, error: 'Message not found' });
    }
    
    res.json({ success: true, message: message });
  });
});