gestart-admino 2.1.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 576292443287e49e641f58374a71998a7b22f495bf55aeb4e002d6ad1afeba04
-  data.tar.gz: 3fa6cc8fe5fa209113b26f656600eaa49072fb6ea66946daa4f900881ee00691
+  metadata.gz: 6eee888637add8e2859414f6d4c9289fefa200ca94bcde3059136c6a348a41fa
+  data.tar.gz: 35d119dca454b08b6e480877332dc0dc437522713022ec4cdcf4e08a56c6acf9
 SHA512:
-  metadata.gz: 161818d2fc869089fa7c6fb9ea4ffe16f9aa51a91a364484fdce686541dfdad3b8b41a7b9362a3615c9d1a3145324f4ba40fe66676f176dbb3523a3489cc1a8e
-  data.tar.gz: 32d718e86ffee8943eef0f6e55a8a709ae8ec5908c026f1ff4e1d76e8acf815f61864cb7548d514c6d1976fc2115d46cc9c3bd36ee558332b7b05a74b9fb99db
+  metadata.gz: aa3e6560efc97e87fb8b06799d9b56bd641b0d21c70052eac8172e8637629606fe119f415b74ee336377e2f8740aaa530d2006029daa5c5cbfef0d8b8314bbe3
+  data.tar.gz: bd04372a12ec42e70087ededfa4a6f3e510dd259d970ea7af4fe4d778b79d6aa6367b1531579a9ac09076012ab37b638327ddb4ebbc4b0df7b4a6e54ad2a51b7

data/CHANGELOG.md

@@ -1,3 +1,33 @@
+# v2.2.0 — parameters are filtered against the configuration
+
+`Query::Base#initialize` now drops anything the query object has not declared,
+instead of handing the whole params hash to the scopes. This is the SEC-4
+finding of Gestart's 27/07 audit, and it closes in one place for every caller —
+controllers, interactors and background jobs alike — because every chain goes
+through this constructor.
+
+The whitelist is not new configuration: it is read from what the query object
+already declares. `search_field` and `filter_by` names are permitted inside the
+nested `query` hash; `page`, `sorting` and `sort_order` are permitted at the top
+level. Nothing else survives.
+
+`permit_params` is the hook for a query object that legitimately reads another
+top-level key:
+
+```ruby
+class ThingQuery < GestartAdmino::Query::Base
+  permit_params :scope_id
+end
+```
+
+Filtering happens after the params are normalised, so it applies however they
+arrived — `to_unsafe_h`, a plain hash, or a hash rebuilt by a job.
+
+Note that this does not make interpolated `order` clauses safe, nor does it
+validate the values themselves: it bounds which keys exist, not what they hold.
+
+---
+
 # v2.1.0 — off showcase, onto gestart-showcase
 
 The `showcase` dependency becomes `gestart-showcase ~> 1.0`, and the eight files

data/lib/gestart_admino/query/base.rb

@@ -17,6 +17,8 @@ module GestartAdmino
       include ActiveModel::Conversion
       extend Dsl
 
+      TOP_LEVEL_PARAMS = %i[page sorting sort_order].freeze
+
       attr_reader :params
       attr_reader :context
       attr_reader :filter_groups
@@ -28,14 +30,16 @@ module GestartAdmino
       end
 
       def initialize(params = nil, context = {}, config = nil)
-        @params =
+        @config = config
+        @context = context
+
+        raw =
           if params.respond_to?(:to_unsafe_h)
             ActiveSupport::HashWithIndifferentAccess.new(params.to_unsafe_h)
           else
             ActiveSupport::HashWithIndifferentAccess.new(params)
           end
-        @config = config
-        @context = context
+        @params = permitted_params(raw)
 
         init_filter_groups
         init_search_fields
@@ -119,6 +123,17 @@ module GestartAdmino
           @sorting = Sorting.new(config.sorting, params, i18n_key)
         end
       end
+
+      def permitted_params(raw)
+        filtered = raw.slice(*TOP_LEVEL_PARAMS, *config.permitted_params)
+
+        nested = raw[:query]
+        if nested.is_a?(Hash)
+          filtered[:query] = nested.slice(*config.declared_query_keys)
+        end
+
+        filtered
+      end
     end
   end
 end

data/lib/gestart_admino/query/configuration.rb

@@ -71,12 +71,22 @@ module GestartAdmino
       attr_reader :search_fields
       attr_reader :filter_groups
       attr_reader :sorting
+      attr_reader :permitted_params
       attr_accessor :starting_scope_callable
       attr_accessor :ending_scope_callable
 
       def initialize
         @search_fields = []
         @filter_groups = []
+        @permitted_params = []
+      end
+
+      def add_permitted_params(*names)
+        @permitted_params |= names.flatten.map(&:to_sym)
+      end
+
+      def declared_query_keys
+        search_fields.map(&:name) + filter_groups.map(&:name)
       end
 
       def add_search_field(name, options = {})

data/lib/gestart_admino/query/dsl.rb

@@ -26,6 +26,10 @@ module GestartAdmino
         config.add_sorting_scopes(args, options)
       end
 
+      def permit_params(*names)
+        config.add_permitted_params(*names)
+      end
+
       def starting_scope(&block)
         config.starting_scope_callable = block
       end

data/lib/gestart_admino/version.rb

@@ -1,3 +1,3 @@
 module GestartAdmino
-  VERSION = "2.1.0"
+  VERSION = "2.2.0"
 end

data/spec/gestart_admino/query/base_spec.rb

@@ -186,6 +186,103 @@ module GestartAdmino
           end
         end
       end
+
+      describe 'parameter filtering' do
+        let(:config) { Configuration.new }
+
+        before do
+          config.add_search_field(:search_field)
+          config.add_filter_group(:filter_group, [:one, :two])
+          config.add_sorting_scopes([:title, :year])
+        end
+
+        context 'with an undeclared nested key' do
+          let(:params) do
+            { query: { search_field: 'foo', injected: 'evil' } }
+          end
+
+          it 'drops it' do
+            expect(query.params[:query]).to eq('search_field' => 'foo')
+          end
+
+          it 'keeps it away from the scope' do
+            result = query.scope(ScopeMock.new('start'))
+            expect(result.chain).not_to include(:injected)
+          end
+        end
+
+        context 'with an undeclared top level key' do
+          let(:params) { { evil: 'payload', sorting: 'title' } }
+
+          it 'drops it and keeps the declared one' do
+            expect(query.params.keys).to eq %w[sorting]
+          end
+        end
+
+        context 'with declared keys' do
+          let(:params) do
+            {
+              query: { search_field: 'foo', filter_group: 'one' },
+              sorting: 'title',
+              sort_order: 'desc'
+            }
+          end
+
+          it 'passes them through untouched' do
+            expect(query.params).to eq(
+              'query' => { 'search_field' => 'foo', 'filter_group' => 'one' },
+              'sorting' => 'title',
+              'sort_order' => 'desc'
+            )
+          end
+
+          it 'still builds the whole scope chain' do
+            result = query.scope(ScopeMock.new('start'))
+            expect(result.chain).to eq [
+              :search_field, ['foo'],
+              :one, [],
+              :title, [:desc]
+            ]
+          end
+        end
+
+        context 'with page' do
+          let(:params) { { page: '2' } }
+
+          it 'keeps it, even though no config declares it' do
+            expect(query.params[:page]).to eq '2'
+          end
+        end
+
+        context 'with a sorting value outside the declared scopes' do
+          let(:params) { { sorting: 'evil_scope' } }
+
+          it 'keeps the key but leaves the scope unapplied, as before' do
+            result = query.scope(ScopeMock.new('start'))
+            expect(result.chain).to eq []
+          end
+        end
+
+        context 'with a query object declaring extra top level params' do
+          let(:query_klass) do
+            Class.new(Base) do
+              permit_params :pending
+
+              def self.model_name
+                ActiveModel::Name.new(self, nil, 'temp')
+              end
+            end
+          end
+
+          subject(:query) { query_klass.new(params) }
+
+          let(:params) { { pending: 'true', evil: 'payload' } }
+
+          it 'keeps the declared one and drops the rest' do
+            expect(query.params.keys).to eq %w[pending]
+          end
+        end
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gestart-admino
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.2.0
 platform: ruby
 authors:
 - Gestart Cloud S.r.l.