Fix REST endpoint /set not enforcing queryModifier on existing documents#404
Closed
Fix REST endpoint /set not enforcing queryModifier on existing documents#404
Conversation
The /set REST endpoint only validated the client-provided new document state against the queryModifier. An authenticated user that knew a primary key of a document owned by another user could overwrite it by sending a new state that matched their own queryModifier restriction. Apply the same docDataMatcherWrite check to the current server-side document, consistent with the behavior of /delete. Also add a performance test suite for the queryModifier hot paths so future regressions are easier to spot.
Owner
Author
|
@copilot do not add performance tests in this pr |
Agent-Logs-Url: https://github.com/pubkey/rxdb-server/sessions/99c14492-ee9b-47cc-8a8a-6d3d6bb0d381 Co-authored-by: pubkey <8926560+pubkey@users.noreply.github.com>
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains:
Describe the problem you have without this PR
The REST endpoint
/sethandler only validated that the new document state matched thequeryModifier, but did not validate that the existing document being updated was visible to the authenticated user under the samequeryModifier. This allowed an authenticated user to overwrite documents owned by other users if they knew the primary key, bypassing access control.For example, a user authenticated as 'alice' could overwrite a document owned by 'bob' by sending a
/setrequest with the correct primary key and a new document state that passes the queryModifier check.Changes
Source Code
/sethandler to check that the existing document matches thequeryModifierbefore allowing an update. The handler now:docDataMatcherWrite)Tests
should not allow overwriting an existing document that does not match the queryModifierto verify that attempting to overwrite a document owned by another user is rejected with a 403 error/queryand/setendpoints with queryModifier to track performance of the hot pathsDocumentation
Test Plan
The fix is covered by:
@pubkey
https://claude.ai/code/session_013rJpm4ZQGCbXdacEAkkVta