Securing Review Submissions

package com.codesignal.pastebin.controller;

import com.codesignal.pastebin.model.Review;
import com.codesignal.pastebin.model.User;
import com.codesignal.pastebin.repo.ReviewRepository;
import com.codesignal.pastebin.repo.UserRepository;
import com.codesignal.pastebin.util.JwtUtil;
import com.auth0.jwt.interfaces.DecodedJWT;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api")
public class ReviewController {
    private final ReviewRepository reviews;
    private final UserRepository users;
    private final JwtUtil jwt;

    public ReviewController(ReviewRepository reviews, UserRepository users, JwtUtil jwt) {
        this.reviews = reviews;
        this.users = users;
        this.jwt = jwt;
    }

    @PostMapping("/reviews")
    public ResponseEntity<?> createReview(@RequestHeader(value = "authorization", required = false) String authorization,
                                          @RequestBody CreateReviewRequest req) {
        // Vulnerable: No rate limiting or bot protection
        
        // Extract user from JWT
        String token = authorization.startsWith("Bearer ") ? authorization.substring(7) : authorization;
        DecodedJWT decoded = jwt.verify(token);
        Integer userId = decoded.getClaim("userId").asInt();
        
        Review review = new Review();
        review.setProductId(req.productId());
        review.setRating(req.rating());
        review.setComment(req.comment());
        review.setUserId(userId);
        
        Review savedReview = reviews.save(review);
        
        return ResponseEntity.ok(savedReview);
    }

    public record CreateReviewRequest(String productId, Integer rating, String comment) {}
}

curl -X POST http://localhost:3000/api/reviews \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <JWT Token>" \
  -d "{\"productId\":\"123\",\"rating\":1,\"comment\":\"Terrible product!\"}"

package com.codesignal.pastebin.service;

import io.github.bucket4j.Bandwidth;
import io.github.bucket4j.Bucket;
import org.springframework.stereotype.Service;

import java.time.Duration;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;

@Service
public class RateLimitService {
    private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();

    public Bucket resolveBucket(String key) {
        return buckets.computeIfAbsent(key, k -> createNewBucket());
    }

    private Bucket createNewBucket() {
        // Limit to 3 reviews per hour
        Bandwidth limit = Bandwidth.builder()
            .capacity(3)
            .refillIntervally(3, Duration.ofHours(1))
            .build();
        return Bucket.builder()
                .addLimit(limit)
                .build();
    }
}

package com.codesignal.pastebin.controller;

import com.codesignal.pastebin.model.Review;
import com.codesignal.pastebin.model.User;
import com.codesignal.pastebin.repo.ReviewRepository;
import com.codesignal.pastebin.repo.UserRepository;
import com.codesignal.pastebin.service.RateLimitService;
import com.codesignal.pastebin.util.ErrorResponse;
import com.codesignal.pastebin.util.JwtUtil;
import com.auth0.jwt.interfaces.DecodedJWT;
import io.github.bucket4j.Bucket;
import jakarta.servlet.http.HttpServletRequest;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

import java.util.Map;

@RestController
@RequestMapping("/api")
public class ReviewController {
    private final ReviewRepository reviews;
    private final UserRepository users;
    private final JwtUtil jwt;
    private final RateLimitService rateLimitService;

    public ReviewController(ReviewRepository reviews, UserRepository users, 
                          JwtUtil jwt, RateLimitService rateLimitService) {
        this.reviews = reviews;
        this.users = users;
        this.jwt = jwt;
        this.rateLimitService = rateLimitService;
    }

    @PostMapping("/reviews")
    public ResponseEntity<?> createReview(@RequestHeader(value = "authorization", required = false) String authorization,
                                         @RequestBody CreateReviewRequest req,
                                         HttpServletRequest httpRequest) {
        
        // Rate limiting check
        String clientIp = httpRequest.getRemoteAddr();
        Bucket bucket = rateLimitService.resolveBucket(clientIp);
        
        if (!bucket.tryConsume(1)) {
            return ResponseEntity.status(HttpStatus.TOO_MANY_REQUESTS)
                    .body(new ErrorResponse("Too many reviews submitted. Please try again later."));
        }
        
        // Extract user from JWT
        String token = authorization.startsWith("Bearer ") ? authorization.substring(7) : authorization;
        DecodedJWT decoded = jwt.verify(token);
        Integer userId = decoded.getClaim("userId").asInt();
        
        // Email verification check
        User user = users.findById(userId).orElse(null);
        if (user == null || !user.getEmailVerified()) {
            return ResponseEntity.status(HttpStatus.FORBIDDEN)
                    .body(Map.of(
                        "error", "Email verification required",
                        "message", "Please verify your email address before submitting reviews"
                    ));
        }
        
        // Proceed with review submission
        Review review = new Review();
        review.setProductId(req.productId());
        review.setRating(req.rating());
        review.setComment(req.comment());
        review.setUserId(userId);
        
        Review savedReview = reviews.save(review);
        
        return ResponseEntity.ok(new ReviewResponse(
            savedReview.getId(),
            savedReview.getProductId(),
            savedReview.getUserId(),
            savedReview.getRating(),
            savedReview.getComment(),
            savedReview.getStatus()
        ));
    }

    public record CreateReviewRequest(String productId, Integer rating, String comment) {}
    public record ReviewResponse(Integer id, String productId, Integer userId, 
                                Integer rating, String comment, String status) {}
}