fix(security): prevent cross-book reply hijacking (IDOR)#850
Conversation
Implements parentCommentId verification on comment creation to ensure the parent comment exists, is active, belongs to the same book, and is visible to the current user. Also upgrades js-yaml and react-router-dom to patch known vulnerabilities. Co-authored-by: d-oit <6849456+d-oit@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
🚀 Performance Report⚡ Startup & Interaction
🛠️ CI & Workflow
|
Deploying do-epub-studio with
|
| Latest commit: |
89b343e
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://ed3c57ff.do-epub-studio.pages.dev |
| Branch Preview URL: | https://jules-12959796695073421035-b.do-epub-studio.pages.dev |
github-actions
Bot
added
deps
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 6 |
| Duplication | 12 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Pins `brace-expansion` and `react-router` to secure versions, resolving high-severity dependency vulnerabilities. Implements parentCommentId verification in the comments router to prevent IDOR and cross-contamination. Co-authored-by: d-oit <6849456+d-oit@users.noreply.github.com>
Pins `brace-expansion` and `react-router` to secure versions, resolving high-severity dependency vulnerabilities. Implements parentCommentId verification in the comments router to prevent IDOR and cross-contamination. Resolves Codacy as any warning. Co-authored-by: d-oit <6849456+d-oit@users.noreply.github.com>
1 participant
This pull request addresses an Insecure Direct Object Reference (IDOR) and tenant isolation bypass vulnerability when replying to existing comments. Previously, the API did not verify if the parent comment referenced by
parentCommentIdbelonged to the same book as the new comment or was accessible to the replying user.We have implemented robust validation on
parentCommentIdin the POST/api/books/:bookId/commentsroute. Now, the parent comment is fetched and checked against the following security boundaries:bookIdto prevent cross-book comment nesting and notification leak.If any of these conditions are violated, the API returns a clean, standard JSON error response (
400 Bad Requestor403 Forbidden).We have also added 5 comprehensive unit test cases in
apps/worker/src/__tests__/security.comments-idor.test.tsto cover these edge cases, and upgradedjs-yamlandreact-router-domto patch high-severity vulnerabilities reported bypnpm audit. All quality gates, linting workflows, and test suites across the workspace have passed 100% successfully.PR created automatically by Jules for task 12959796695073421035 started by @d-oit