[security vulnerability] Arbitrary Cart Addition Vulnerability

[GatekeeperBuster]

Recently, our team found an arbitrary cart addition vulnerability in the latest version of the project.

The vulnerability logic is present in the file: https://github.com/GoogleLLP/SuperMarket/blob/master/cart/src/main/java/com/supermarket/cart/controller/CartController.java#L50. Access to the /manage/save API is unauthorized, allowing attackers to add carts for any user via a crafted cart object.

To address this vulnerability, we recommend that developers implement access control policies to ensure that users can only add items to their own cart.