Language: TypeScript
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
export async function sendScanResults(
  payloads: ScanResultsPayload[],
): Promise<boolean> {
  for (const payload of payloads) {
    // Intentionally removing scan results as they would be too big to log
    const payloadWithoutScanResults = { ...payload, scanResults: undefined };
    try {
      const request: KubernetesUpstreamRequest = {
        method: 'post',
        url: `${upstreamUrl}/api/v1/scan-results`,
        payload,
      };

      const { response, attempt } = await reqQueue.push(request);
      if (!isSuccessStatusCode(response.statusCode)) {
        throw new Error(`${response.statusCode} ${response.statusMessage}`);
      } else {
        logger.info(
          { payload: payloadWithoutScanResults, attempt },
          'scan results sent upstream successfully',
        );
      }
    } catch (error) {
      logger.error(
        { error, payload: payloadWithoutScanResults },
        'could not send the scan results upstream',
      );
      return false;
    }
  }

  return true;
}