🔒 Fix IDOR vulnerability in post updates - #79
Conversation
Adds `.select()` to the Supabase `update` operation for posts to return affected rows, throwing a 404 error if empty. This fixes an IDOR vulnerability where unowned post updates silently passed, allowing unauthorized deletion and insertion of keyword associations in subsequent queries. Co-authored-by: Sparkier <5690524+Sparkier@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
1 participant
🎯 What: The vulnerability fixed
Fixed an Insecure Direct Object Reference (IDOR) on the
PATCH /api/post/[id]route where a user could modify keywords of a post they do not own.Previously, the code only checked for a database
errorfrom Supabase on update, but without.select(), Supabase returns success even if no rows match the filterid = params.idandcreator = session.user.email. This allowed unauthorized users to proceed past the check, resulting in the endpoint deleting and re-inserting keywords for posts they did not own, which is a major security flaw.🛡️ Solution: How the fix addresses the vulnerability
Appended
.select()to the Supabaseupdatequery and checked the returneddatapayload. If it is null or empty, it throws a404 Not found or unauthorizederror, preventing the execution from reaching the subsequent keyword deletion/insertion logic. Also added a comprehensive test to verify this behavior correctly blocks unowned post modifications.PR created automatically by Jules for task 17914967494521786957 started by @Sparkier