From a11cb462563b859431cb17dc047409b5ae8d576a Mon Sep 17 00:00:00 2001
From: "deepsource-autofix[bot]"
 <62050782+deepsource-autofix[bot]@users.noreply.github.com>
Date: Fri, 23 May 2025 20:10:11 +0000
Subject: [PATCH] refactor: autofix issues in 1 file

Unsafe deserialization can be vulnerable to many attacks such as denial-of-service, access control, and remote code execution (RCE). Applications and APIs will be vulnerable if they deserialize hostile or tampered objects supplied by an attacker.

This can result in two primary types of attacks:

- Object and data structure-related attacks where the attacker modifies application logic or achieves arbitrary remote code execution if there are classes available to the application that can change behavior during or after deserialization.
- Typical data tampering attacks such as access-control-related attacks where existing data structures are used but the content is changed.

It is recommended to avoid using deserialization. To prevent using deserialization, it is always better not to accept serialized data from untrusted sources or to use serialization mediums that only permit primitive data types.
---
 backend/functions/order-manager/order-manager.js | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/backend/functions/order-manager/order-manager.js b/backend/functions/order-manager/order-manager.js
index a50c17a6..d5cda2b5 100644
--- a/backend/functions/order-manager/order-manager.js
+++ b/backend/functions/order-manager/order-manager.js
@@ -1,4 +1,3 @@
-const serialize = require('node-serialize');
 const { LambdaClient, InvokeCommand } = require("@aws-sdk/client-lambda");
 const { CognitoIdentityProviderClient, AdminGetUserCommand } = require("@aws-sdk/client-cognito-identity-provider");
 const jose = require('node-jose');
@@ -7,25 +6,25 @@ const jose = require('node-jose');
 
 exports.handler = (event, context, callback) => {
     // console.log(JSON.stringify(event));
-    var req = serialize.unserialize(event.body); 
-    var headers = serialize.unserialize(event.headers);
+    var req = JSON.parse(event.body); 
+    var headers = JSON.parse(event.headers);
     var auth_header = headers.Authorization || headers.authorization;
     var token_sections = auth_header.split('.');
     var auth_data = jose.util.base64url.decode(token_sections[1]);
     var token = JSON.parse(auth_data);
     var user = token.username;
     var isAdmin = false;
-    
+
     var params = {
       UserPoolId: process.env.userpoolid,
       Username: user
     };
-    
+
     try {
         const cognitoidentityserviceprovider = new CognitoIdentityProviderClient();
         const command = new AdminGetUserCommand(params);
         const userData = cognitoidentityserviceprovider.send(command);
-        
+
         userData.then((userData)=>{
             // console.log("userData", JSON.stringify(userData));
             var len = Object.keys(userData.UserAttributes).length;
@@ -39,7 +38,7 @@ exports.handler = (event, context, callback) => {
             var isOk = true;
             var payload = {};
             var functionName = "";
-            
+
             switch(action) {
                 case "new":
                     payload = { "user": user, "cartId": req["cart-id"], "items": req["items"] };
@@ -58,7 +57,6 @@ exports.handler = (event, context, callback) => {
 
                 case "get":
                     payload = { "user": user, "orderId": req["order-id"], "isAdmin": isAdmin };
-                    functionName = "DVSA-ORDER-GET";
                     break;
 
                 case "orders":