Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Add creator_id into CreateFlow mutation #826

Closed
wants to merge 3 commits into from
Closed

fix: Add creator_id into CreateFlow mutation #826

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
67bb8b5
fix: Add creator_id into CreateFlow mutation
DafyddLlyr Jan 25, 2022
888e5a1
fix: Refactor and rethink, parse JWT once and persist to RoutingContext
DafyddLlyr Jan 26, 2022
c45c295
fix: Remove redundant util func
DafyddLlyr Feb 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions editor.planx.uk/src/pages/FlowEditor/lib/store/editor.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import debounce from "lodash/debounce";
import isEmpty from "lodash/isEmpty";
import omitBy from "lodash/omitBy";
import type { FlowSettings, TextContent } from "types";
import { getLoggedInUserId } from "utils";
import type { GetState, SetState } from "zustand/vanilla";

import { FlowLayout } from "../../components/Flow";
Expand Down Expand Up @@ -147,11 +148,23 @@ export const editorStore = (

createFlow: async (teamId, newSlug) => {
const data = { [ROOT_NODE_KEY]: { edges: [] } };
const creatorId = getLoggedInUserId();
let response = (await client.mutate({
mutation: gql`
mutation CreateFlow($data: jsonb, $slug: String, $teamId: Int) {
mutation CreateFlow(
$data: jsonb
$slug: String
$teamId: Int
$creatorId: Int
) {
insert_flows_one(
object: { data: $data, slug: $slug, team_id: $teamId, version: 1 }
object: {
data: $data
slug: $slug
team_id: $teamId
version: 1
creator_id: $creatorId
Copy link
Contributor

@johnrees johnrees Jan 28, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there might be a bit of a security issue here that could get flagged by a security audit in future. It might be that we can ignore it for the time being though*

The issue is - a user could potentially set any creator_id they wanted with some sneaky frontend code tweaking, or by looking at the network request and then replaying it with a different creator_id of their choosing.

The way around it would be to extract the x-hasura-user-id from the JWT in hasura itself, so in the hasura console, you'd set creator_id to have the default value of x-hasura-user-id and have permissions so that creator_id can't be overridden.

https://hasura.io/docs/latest/graphql/core/databases/postgres/schema/default-values/column-presets.html#step-1-configure-a-column-preset

e.g.
Screenshot 2022-01-28 at 2 14 38 AM

Doing that should mean that it's impossible for someone to spoof the creator_id.

* However, IIRC we've all got full admin permissions right now anyway, which is why I think we might have bigger problems than this if we had an audit soon. Hmm 🤔

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's very helpful feedback thanks - I'll take a crack at this approach.

}
) {
id
data
Expand All @@ -162,6 +175,7 @@ export const editorStore = (
slug: newSlug,
teamId,
data,
creatorId,
},
})) as any;

Expand Down
13 changes: 13 additions & 0 deletions editor.planx.uk/src/utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
import jwtDecode from "jwt-decode";

import { getCookie } from "./lib/cookie";

export function removeAt<T>(index: number, arr: Array<T>): Array<T> {
return arr.filter((_item, i) => {
return i !== index;
Expand Down Expand Up @@ -52,3 +56,12 @@ export function slugify(name: string): string {
.replace(/[\s_-]+/g, "-") // swap any length of whitespace, underscore, hyphen characters with a single -
.replace(/^-+|-+$/g, ""); // remove leading, trailing -
}

export function getLoggedInUserId(): number | undefined {
const jwt = getCookie("jwt");
if (!jwt) return;
const userId = Number(
(jwtDecode(jwt) as any)["https://hasura.io/jwt/claims"]["x-hasura-user-id"]
);
return userId;
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do you think it's worth refactoring this block to use the same bit of code?

planx-new/editor.planx.uk/src/index.tsx

Lines 34 to 43 in 67bb8b5

if (
Number(
(jwtDecode(jwt) as any)["https://hasura.io/jwt/claims"][
"x-hasura-user-id"
]
) > 0
) {
return true;
}
} catch (e) {}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch - looking at this lead me to have a bit of a rethink, see comment below.