Fix Mass Assignment in Dataset and DatasetRow Operations

[christopherholland-workday]

Flowise-323 (See testing section for Dataset and DatasetRow)

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical security vulnerability related to mass assignment in dataset and dataset row operations. By replacing generic Object.assign calls with explicit property assignments, the changes ensure that only intended fields can be modified during creation and update processes, significantly enhancing the application's security posture and preventing potential data manipulation by malicious actors.

Highlights

• Security Fix: Prevented mass assignment vulnerability in createDataset by explicitly assigning name, description, and workspaceId properties.
• Security Fix: Prevented mass assignment vulnerability in updateDataset by explicitly assigning name and description properties.
• Security Fix: Prevented mass assignment vulnerability in addDatasetRow by explicitly assigning input, output, and datasetId properties.
• Security Fix and Bug Fix: Prevented mass assignment vulnerability in updateDatasetRow by explicitly assigning input and output properties, and corrected the source of datasetId when calling changeUpdateOnDataset.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request refactors dataset and dataset row creation and update operations to use explicit property assignments instead of Object.assign, aiming to prevent mass assignment vulnerabilities. However, the review highlights several critical and high-severity security vulnerabilities related to Insecure Direct Object Reference (IDOR) and missing authorization checks. Specifically, in updateDatasetRow, the authorization check occurs after the update, allowing unauthorized modifications. In createDataset, passing workspaceId directly from the request body is identified as a potential IDOR risk. Furthermore, in addDatasetRow, a missing authorization check before row creation could allow attackers to add data to unauthorized datasets.

[christopherholland-workday]

/gemini review

[gemini-code-assist]

Code Review

This pull request refactors the creation and update logic for datasets and dataset rows. It moves from using Object.assign with the entire request body to explicitly assigning specific properties such as name, description, input, output, workspaceId, and datasetId. This change improves data integrity and security by preventing unintended property assignments. Additionally, the PR introduces workspaceId checks for addDatasetRow and updateDatasetRow operations, enhancing access control by ensuring dataset rows are only manipulated within their designated workspaces. A review comment suggests improving the error message in updateDatasetRow to more accurately reflect that a dataset might not be found due to workspace access issues, rather than the row itself being missing.

[gemini-code-assist]

The error message here (Dataset Row ${id} not found) might be misleading. If dataset is null, it means the dataset associated with the row (item.datasetId) was not found for the provided workspaceId. This indicates an access issue or a data inconsistency, not that the Dataset Row ${id} itself is missing (as item was successfully retrieved earlier). Consider a more precise message like Dataset ${item.datasetId} not found for workspace or Access denied to Dataset Row ${id}.

[0xi4o]

Just one nitpick. Good to go otherwise.

[0xi4o]

Can overwrite workspaceId without having to reassign every field:

Object.assign(newDs, body, {
  workspaceId,
})

[christopherholland-workday]

However, there are other fields as well that we don't want to allow update for through the request, e.g. updatedTime. I think it could get more complicated with this?

[0xi4o]

We can use the stripProtectedFields in packages/server/src/utils/ for this. This function removes all server-managed fields from request body.