Secure user-scoped endpoints by validating attendee ownership#256
Secure user-scoped endpoints by validating attendee ownership#256oPeras1 wants to merge 2 commits intosinfo:masterfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR addresses an insecure direct object reference (IDOR) in attendee-scoped link endpoints by enforcing that user-scoped requests can only operate on the authenticated attendee’s own attendeeId, while preserving existing elevated access for team/admin.
Changes:
- Added
checkAttendeeAccess(credentials, attendeeId)and registered it as a server method. - Enforced attendee ownership checks across attendee link CRUD/list handlers (
/users/{attendeeId}/link*).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| server/routes/link/handlers.js | Adds ownership checks before performing attendee link operations. |
| server/resources/link.js | Introduces and registers link.checkAttendeeAccess used by the routes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| const edition = await request.server.methods.deck.getLatestEdition() | ||
| await request.server.methods.link.checkAttendeeAccess(request.auth.credentials, request.params.attendeeId) | ||
| await request.server.methods.link.checkCompany(request.payload.userId, request.payload.companyId, edition.id) | ||
| let link = await request.server.methods.link.create(request.params.attendeeId, request.payload, "attendee", edition.id) |
There was a problem hiding this comment.
This change introduces new authorization behavior for user-scoped attendee link endpoints, but there doesn’t appear to be test coverage for the /users/{attendeeId}/link* routes. Please add tests that assert a user cannot create/get/list/update/delete links for a different attendeeId (expect 403), while team/admin can still access as intended.
There was a problem hiding this comment.
Wont do, exercicio para o leitor
Co-authored-by: Copilot <[email protected]>
Fix an insecure direct object reference vulnerability in attendee link endpoints where user-scoped routes allowed operations on arbitrary attendeeId/companyId values without verifying ownership.
Several endpoints accept user-controlled identifiers from request parameters and perform actions without confirming that the authenticated user is authorized to access or modify the target attendee’s data.