fix: add CSRF protection in data.js

[anupamme]

Summary

Fix high severity security issue in src/redux/data.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	src/redux/data.js:584
Assessment	Likely exploitable
CWE	CWE-352
Chain Complexity	2-step

Description: The application makes state-changing API requests (POST, PUT, DELETE) using fetch() with credentials: 'include' for session cookie transmission. No CSRF token is included in request headers or body. The headers object contains X-Okapi-Tenant and X-Okapi-Token but no CSRF protection header, leaving the application vulnerable to cross-origin attacks.

Evidence

Exploitation scenario: An attacker creates a malicious webpage that triggers hidden form submissions or fetch requests to eHoldings API endpoints.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web application - XSS and injection vulnerabilities can affect end users.

Changes

• src/redux/data.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: The security boundary is maintained under adversarial input

Regression test

const { fetchUtils } = require('./src/redux/data');

describe("state-changing requests must include CSRF protection header", () => {
  const testCases = [
    { method: 'POST', description: 'POST without CSRF token' },
    { method: 'PUT', description: 'PUT without CSRF token' },
    { method: 'DELETE', description: 'DELETE without CSRF token' },
  ];

  test.each(testCases)("requires CSRF header for $description", async ({ method }) => {
    global.fetch = jest.fn(() => Promise.resolve({ ok: true }));
    
    const headers = { 'X-Okapi-Tenant': 'test-tenant', 'X-Okapi-Token': 'test-token' };
    
    await fetchUtils.fetch('/api/resource', { headers, method, credentials: 'include' });
    
    const requestHeaders = fetch.mock.calls[0][1].headers;
    const hasCsrfHeader = Object.keys(requestHeaders).some(key => 
      key.toLowerCase().includes('csrf') || key.toLowerCase().includes('xsrf')
    );
    
    expect(hasCsrfHeader).toBe(true);
  });
});

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security

[zepheiryan]

Closing per #1850