[security vulnerability] Arbitrary Cart Deletion Vulnerability

[GatekeeperBuster]

Recently, our team found an arbitrary cart deletion vulnerability in the latest version of the project.

The vulnerability logic is present in the file: https://github.com/GoogleLLP/SuperMarket/blob/master/cart/src/main/java/com/supermarket/cart/controller/CartController.java#L96. Access to the /manage/delete API is unauthorized, allowing attackers to delete arbitrary cart via a crafted cart object.

To address this vulnerability, we recommend that developers implement access control policies to limit API access to privileged users and cart owners only.