Language: TypeScript
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
export async function sendDepGraph(
  ...payloads: IDependencyGraphPayload[]
): Promise<void> {
  for (const payload of payloads) {
    // Intentionally removing dependencyGraph as it would be too big to log
    // eslint-disable-next-line @typescript-eslint/no-unused-vars
    const { dependencyGraph, ...payloadWithoutDepGraph } = payload;
    try {
      const request: KubernetesUpstreamRequest = {
        method: 'post',
        url: `${upstreamUrl}/api/v1/dependency-graph`,
        payload,
      };

      const { response, attempt } = await reqQueue.push(request);
      if (!isSuccessStatusCode(response.statusCode)) {
        throw new Error(`${response.statusCode} ${response.statusMessage}`);
      } else {
        logger.info(
          { payload: payloadWithoutDepGraph, attempt },
          'dependency graph sent upstream successfully',
        );
      }
    } catch (error) {
      logger.error(
        { error, payload: payloadWithoutDepGraph },
        'could not send the dependency scan result upstream',
      );
    }
  }
}