bola--idor-vulnerability-scannerlisted

# BOLA / IDOR Vulnerability Scanner ## 1. System Architecture & Prerequisites - Python 3.10+ (stdlib only: `re`, `os`, `json`, `argparse`, `urllib.request`, `urllib.error`, `pathlib`) - Target: local source tree (Express/Node or FastAPI route handlers) AND/OR a live localhost API - No external dependencies; HTTP requests use `urllib.request` (no `requests` needed) ## 2. Input/Output Data Contracts **Input (CLI args):** ```json { "type": "object", "properties": { "source": { "type": "string", "description": "Source root with route handlers (.js/.ts/.py)" }, "base_url": { "type": "string", "description": "Live localhost API base, e.g. http://127.0.0.1:8000" }, "user_id": { "type": "string", "description": "Authenticated user ID used for tampering tests" }, "report_dir": { "type": "string", "description": "Output directory", "default": "./bola-reports" } }, "required": ["source"] } ``` **Runtime tampering test contract (POST `{base_url}/test`):** ```json { "method": "GET", "url": "/api/orders/1", "path": "/api/orders/:id", "headers": {}, "cookies": {}, "tampered_ids": [2, 3, 1001], "userId": "user-1" } ``` **Output artifacts:** - `{report_dir}/bola_report.json` — structured BOLA findings - `{report_dir}/express_requireOwnership.js` — Express middleware guard - `{report_dir}/fastapi_dependency.py` — FastAPI dependency guard ## 3. Production Reference Implementation ```python #!/usr/bin/env python3 """BOLA / IDOR Vulnerability Scanner — static rout