Language: TypeScript
Label: vulnerable
CWE: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Code:
const protectRoute = (query, info) => {
  const savePopulate = protectPopulate(query, info);
  query.populate = savePopulate.populate;
  query.fields = savePopulate.fields;
  query.filters = protectFilters(query.filters, info);
  return query;
};