This is an easy fix. The fix is to just remove one line of code that sets the "X-Powered-By" HTTP header, which is even mentioned already in the task description.

Level 1 - Broken access control

Again an easy fix. This time one line of code needs to be added, which sets the auth parameter correctly so that only an Employee or Chef can use the method. The correct line of code can be copied from one of the other function in the file.

Level 2 - Broken access control

This level took a little longer to figure out how to fix the issue in a way that didn't break the test. In the end it was fixed by two changes, one to verify that the provided username matches the current user and one change to not return current_user but db_user

Level 3 - Privilege escalation (BAC)

Function update_user_role was missing a check that only allows users of type EMPLOYEE. The fix is to add this check and raise an exception for non-employee users. I chose to return 401: Unauthorized, which is also used elsewhere, but 403: Forbidden would also be a viable status code.

Level 4 - SSRF

I found this a nice excercise, for me SSRF was always somewhat mysterious but this provides an example of how it could work. I implemented several validations here. First the url is parsed with urlparse. Then I validate that 1. the url starts with http or https. Next the domain is checked against a whitelist of domains (only localhost in this case). Finally, the path segment of the url should end with one of the most common web image formats (".jpg", ".jpeg", ".png", ".gif", "svg", "webp")

Note: In a real application you probably want to use a library that can verify if the url points to an actual image.

If any check fails, an HTTPException is raised.

Level 5 - RCE

Another nice exercise. I must give some credits here to Copilot that helped me out by providing the code to make the function safer by creating a list of parameters and use that with shell=False