Skip to content

fix(#392): 브랜드 상세 조회 API에서 브랜드의 유저의 ID가 나올 수 있도록 변경 #393

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Yoonchulchung merged 1 commit into from
Feb 12, 2026
Merged

fix(#392): 브랜드 상세 조회 API에서 브랜드의 유저의 ID가 나올 수 있도록 변경 #393

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/main/java/com/example/RealMatch/brand/application/service/BrandService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,7 @@ public BrandDetailResponseDto getBrandDetail(Long brandId, Long currentUserId) {
BrandDetailResponseDto.BrandDetailResponseDtoBuilder responseBuilder = BrandDetailResponseDto.builder()
.userId(currentUserId)
.brandName(brand.getBrandName())
.brandUserId(String.valueOf(brand.getUser().getId()))
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

This line exposes the internal userId of the brand's owner, leading to a high-severity information disclosure vulnerability. This can enable Insecure Direct Object Reference (IDOR) attacks and user enumeration. It is strongly recommended to avoid exposing internal database identifiers in API responses. If a unique identifier is required, use a non-sequential, non-guessable public identifier (e.g., a UUID). The code review also suggested changing the type from String to Long for brandUserId to align with brand.getUser().getId()'s return type, but the primary concern is the exposure of the ID itself.

.brandImages(brandImages)
.logoUrl(brand.getLogoUrl())
.simpleIntro(brand.getSimpleIntro())
Expand Down
1 change: 1 addition & 0 deletions ...in/java/com/example/RealMatch/brand/presentation/dto/response/BrandDetailResponseDto.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
public class BrandDetailResponseDto {
private Long userId;
private String brandName;
private String brandUserId;
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

This brandUserId field is intended to carry a sensitive internal user ID. Exposing internal user IDs in API responses is a high-severity security risk, potentially leading to Insecure Direct Object Reference (IDOR) vulnerabilities and other attacks. It is strongly recommended to remove this field entirely to avoid exposing internal identifiers. Additionally, as per repository rule 'Avoid adding fields to a DTO if they are not currently required by a consumer', this field should not be present if it's not securely required by a consumer. While the code review suggested changing its type to Long for consistency, the primary concern is the exposure of the ID itself.

References
  1. Avoid adding fields to a DTO if they are not currently required by a consumer, even if they were present in a previous version.

private List<String> brandImages;
private String logoUrl;
private String simpleIntro;
Expand Down
Loading