Product route: PUT replaces entire object with unsanitized input

[thomasiverson]

Severity: High

Category: Security

Description

In api/src/routes/product.ts (line 115), products[index] = req.body allows a client to inject arbitrary properties (prototype pollution risk) and also loses the original productId if the client omits it.

// Current — wholesale replacement
products[index] = req.body;

Suggested Fix

Merge explicitly and preserve the ID:

products[index] = { ...req.body, productId: products[index].productId };

Or better yet, whitelist allowed fields:

const { name, description, price, supplierId, stockLevel, imgName } = req.body;
products[index] = { ...products[index], name, description, price, supplierId, stockLevel, imgName };

Affected File

• api/src/routes/product.ts (line 115)