Review generated invoice updater

from Web security fundamentals
Node 24 advanced 10 min 4 issues to find

Review this AI-generated invoice update handler against its task and identify four distinct problems.

Update an invoice total for the authenticated principal, only inside that principal's tenant, and return the updated invoice.

JavaScript
async function updateInvoice(req, db, audit) {
  const principal = req.body.principal;
  const invoiceId = req.params.id;
  const totalCents = Number(req.body.totalCents);

  const lookup = await db.query(
    'SELECT id, total_cents FROM invoices WHERE id = $1 AND tenant_id = $2',
    [invoiceId, principal.tenantId],
  );
  if (lookup.rows.length === 0) return { status: 404 };

  await db.query(
    'UPDATE invoices SET total_cents = $1 WHERE id = $2',
    [totalCents, invoiceId],
  );
  audit.write({ actor: principal.id, invoiceId });

  return { status: 200, body: lookup.rows[0] };
}

generated code is illustrative, not from any one model

Open in playground
Report an error