Find the authorization, input-handling, and secret-exposure defects in this generated profile handler.
JavaScript
async function updateProfile(request, store, audit) {
const profile = await store.find(request.body.userId);
if (!profile) {
return { status: 404, body: { error: "not found" } };
}
if (request.body.displayName.length > 80) {
return { status: 400, body: { error: "too long" } };
}
profile.displayName = request.body.displayName.trim();
audit.push({
authorization: request.headers.authorization,
profile,
});
await store.save(profile);
return { status: 200, body: profile };
}