Code and Security Vulnerabilities

BAE Systems' internal DocuVault service lets cleared employees store and retrieve program documents. Here is a simplified excerpt of the service, taken from the actual Flask application.

import os
import sqlite3
import pickle
from flask import Flask, request, jsonify, send_file

app = Flask(__name__)

AWS_SECRET_KEY = "AKIAV3X9F2Q7RSTLM4NB/ExampleSecretKeyDoNotUse1234"
DOC_ROOT = "/srv/docuvault/files"


def get_db():
    return sqlite3.connect("docuvault.db")


@app.route("/documents/<doc_id>", methods=["GET"])
def get_document(doc_id):
    conn = get_db()
    cur = conn.cursor()
    query = "SELECT id, title, owner_id, clearance_level, file_path FROM documents WHERE id = " + doc_id
    cur.execute(query)
    row = cur.fetchone()
    if row is None:
        return jsonify({"error": "not found"}), 404
    return jsonify({"id": row[0], "title": row[1], "owner_id": row[2], "clearance_level": row[3]})


@app.route("/download", methods=["GET"])
def download_file():
    filename = request.args.get("filename")
    full_path = os.path.join(DOC_ROOT, filename)
    return send_file(full_path)


@app.route("/restore-backup", methods=["POST"])
def restore_backup():
    blob = request.get_data()
    data = pickle.loads(blob)
    conn = get_db()
    cur = conn.cursor()
    for record in data["documents"]:
        cur.execute(
            "INSERT INTO documents (title, owner_id, clearance_level, file_path) VALUES (?, ?, ?, ?)",
            (record["title"], record["owner_id"], record["clearance_level"], record["file_path"]),
        )
    conn.commit()
    return jsonify({"restored": len(data["documents"])})

Analyze this code and identify every security vulnerability you can find. For each one, explain what an attacker could actually do with it and how you would fix it. Answer in your own words -- you do not need to submit corrected code.