feat(catalog): add catalogue normalisation rules and lookup endpoint

[ogulcan-gurcaglar]

Adds catalogue normalisation helpers and the rules lookup endpoint.

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 755ca2a.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/catalogRules.ts:13015
  • Score: HIGH (89.0)
  • Description: The newly added public /rest/catalog/rules route passes the attacker-controlled rule query parameter directly into a Sequelize raw SQL statement. Because the route is mounted without an authorization middleware, an anonymous user can inject SQL and read or manipulate database data depending on the database driver's capabilities.

Evidence: const rule = req.query.rule ?? '' is interpolated into models.sequelize.query(SELECT * FROM Products WHERE name = '${rule}') with no parameter binding, escaping, validation, or authorization guard. server.ts mounts it as app.get('/rest/catalog/rules', catalogRules()) before any route-local protection.

• Link to UI: https://staging.branch.zeropath.com/app/issues/9daeeef4-eb12-4751-9b67-1f434a7178be (Issue 1, id: 9daeeef4-eb12-4751-9b67-1f434a7178be)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=16cb7921-8247-4297-9e99-d28a2b573f19&codeScanTypes=PrScan&tab=issues

Detected Code Changes

The diff is too large to display a summary of code changes.

[zeropath-ai-staging]

SQL Injection in /rest/catalog/rules (routes/catalogRules.ts) (Severity: HIGH)

An anonymous user can inject SQL via the rule query parameter because it is interpolated directly into a raw SQL statement in routes/catalogRules.ts, which causes data exposure or manipulation. The code reads req.query.rule with no validation or parameter binding and builds a query like SELECT * FROM Products WHERE name = '${rule}', leading to unauthorized access since server.ts mounts the route without authorization middleware.
_{View details in ZeroPath}

Suggested fix

_{Unable to apply as inline suggestion. Download .diff and apply from repo root with git apply 9daeeef4.diff}

diff --git a/routes/catalogRules.ts b/routes/catalogRules.ts
--- a/routes/catalogRules.ts
+++ b/routes/catalogRules.ts
@@ -13008,8 +13008,8 @@
 
 module.exports = function catalogRules () {
   return (req: Request, res: Response, next: NextFunction) => {
-    const rule = req.query.rule ?? ''
-    models.sequelize.query(`SELECT * FROM Products WHERE name = '${rule}'`)
+    const rule = String(req.query.rule ?? '')
+    models.sequelize.query('SELECT * FROM Products WHERE name = :rule', { replacements: { rule } })
       .then(([rows]: any) => { res.json({ rows }) })
       .catch((error: Error) => { next(error) })
   }

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 755ca2a.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/catalogRules.ts:13014
  • Score: HIGH (88.0)
  • Description: The newly registered GET /rest/catalog/rules endpoint inserts the attacker-controlled rule query parameter directly into a raw SQL statement without parameterization or authorization. An unauthenticated remote caller can terminate the string and inject SQL, allowing arbitrary read queries against the database and potentially stacked/destructive queries depending on the SQLite/Sequelize configuration.

Evidence: const rule = req.query.rule ?? '' is used in models.sequelize.query(SELECT * FROM Products WHERE name = '${rule}'); server.ts:575 exposes the handler publicly with no authentication middleware.

• Link to UI: https://staging.branch.zeropath.com/app/issues/cdbbe006-3bf0-48ad-bb34-5ee7fc0cd767 (Issue 1, id: cdbbe006-3bf0-48ad-bb34-5ee7fc0cd767)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=d2d4cc03-9ee0-46c1-9b4b-f79e07fb1291&codeScanTypes=PrScan&tab=issues

Detected Code Changes

The diff is too large to display a summary of code changes.

[zeropath-ai-staging]

SQL Injection in GET /rest/catalog/rules (routes/catalogRules.ts:13014) (Severity: HIGH)

The vulnerability allows an unauthenticated remote user to inject SQL via the rule query parameter, which is directly concatenated into a raw SQL statement in routes/catalogRules.ts:13014 and executed through Sequelize. This leads to arbitrary read (and potentially destructive) queries against the database, since server.ts:575 exposes the endpoint without authentication, enabling public access.
_{View details in ZeroPath}

Suggested fix

_{Unable to apply as inline suggestion. Download .diff and apply from repo root with git apply cdbbe006.diff}

diff --git a/routes/catalogRules.ts b/routes/catalogRules.ts
--- a/routes/catalogRules.ts
+++ b/routes/catalogRules.ts
@@ -13009,7 +13009,7 @@
 module.exports = function catalogRules () {
   return (req: Request, res: Response, next: NextFunction) => {
     const rule = req.query.rule ?? ''
-    models.sequelize.query(`SELECT * FROM Products WHERE name = '${rule}'`)
+    models.sequelize.query('SELECT * FROM Products WHERE name = ?', { replacements: [rule] })
       .then(([rows]: any) => { res.json({ rows }) })
       .catch((error: Error) => { next(error) })
   }

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}