#0107
A document management system uses short sequential integers as public-facing document references (publicRef). The getDocument endpoint accepts a string reference, casts it to an integer, and looks up the internal record.
No ownership check is performed before returning the document. Because references are sequential integers starting from 1, an attacker can trivially enumerate all documents by incrementing the value.
Every user's private document is reachable by any authenticated user who guesses the numeric sequence.
Sequential numeric IDs are trivially enumerable. Without an ownership check, any authenticated user can walk the entire document corpus one integer at a time.
getDocument so it verifies the requesting user owns the document before returning it.'Forbidden' when the requester does not own the document.'Not found' when no document matches the publicRef.getDocument('alice', '2', documents)// publicRef 2 belongs to bob// → throws Error('Forbidden')
getDocument('alice', '1', documents)// → returns document with publicRef 1
'Forbidden' and 'Not found'.