@stamhoofd/backend 2.79.1 → 2.79.2

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.79.1",
+    "version": "2.79.2",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -38,14 +38,14 @@
         "@simonbackx/simple-encoding": "2.21.0",
         "@simonbackx/simple-endpoints": "1.19.1",
         "@simonbackx/simple-logging": "^1.0.1",
-        "@stamhoofd/backend-i18n": "2.79.1",
-        "@stamhoofd/backend-middleware": "2.79.1",
-        "@stamhoofd/email": "2.79.1",
-        "@stamhoofd/models": "2.79.1",
-        "@stamhoofd/queues": "2.79.1",
-        "@stamhoofd/sql": "2.79.1",
-        "@stamhoofd/structures": "2.79.1",
-        "@stamhoofd/utility": "2.79.1",
+        "@stamhoofd/backend-i18n": "2.79.2",
+        "@stamhoofd/backend-middleware": "2.79.2",
+        "@stamhoofd/email": "2.79.2",
+        "@stamhoofd/models": "2.79.2",
+        "@stamhoofd/queues": "2.79.2",
+        "@stamhoofd/sql": "2.79.2",
+        "@stamhoofd/structures": "2.79.2",
+        "@stamhoofd/utility": "2.79.2",
         "archiver": "^7.0.1",
         "aws-sdk": "^2.885.0",
         "axios": "1.6.8",
@@ -65,5 +65,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "88ae0a3e4edb57d36151c551a4c4e3ed59447e05"
+    "gitHead": "595b8c9ed42fb1b9de1dd3facb545ae3c7f9b1a2"
 }

package/src/endpoints/organization/dashboard/registration-periods/PatchOrganizationRegistrationPeriodsEndpoint.ts

@@ -430,6 +430,9 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                         patch.waitingList,
                         model.organizationId,
                         requiredPeriod,
+                        {
+                            allowedIds: [patch.waitingList.id],
+                        },
                     );
                     model.waitingListId = group.id;
                 }
@@ -443,12 +446,14 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
     static async createGroup(struct: GroupStruct, organizationId: string, period: RegistrationPeriod, options?: { allowedIds?: string[] }): Promise<Group> {
         const allowedIds = options?.allowedIds ?? [];
 
-        if (!await Context.auth.hasFullAccess(organizationId)) {
-            if (allowedIds.includes(struct.id)) {
-                // Ok
-            }
-            else {
-                throw Context.auth.error('Je hebt geen toegangsrechten om groepen toe te voegen');
+        if (struct.type === GroupType.Membership || struct.type === GroupType.WaitingList) {
+            if (!await Context.auth.hasFullAccess(organizationId)) {
+                if (allowedIds.includes(struct.id)) {
+                    // Ok
+                }
+                else {
+                    throw Context.auth.error('Je hebt geen toegangsrechten om groepen toe te voegen');
+                }
             }
         }
 
@@ -493,15 +498,15 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
             user.permissions!.organizationPermissions.set(organizationId, organizationPermissions.patch(patch));
             console.log('Automatically granted author full permissions to resource', 'group', model.id, 'user', user.id, 'patch', patch.encode({ version: Version }));
             await user.save();
-        }
 
-        // Check if current user has permissions to this new group -> else fail with error
-        if (!await Context.auth.canAccessGroup(model, PermissionLevel.Full)) {
-            throw new SimpleError({
-                code: 'missing_permissions',
-                message: 'You cannot restrict your own permissions',
-                human: 'Je kan geen inschrijvingsgroep maken zonder dat je zelf volledige toegang hebt tot de nieuwe groep',
-            });
+            // Check if current user has permissions to this new group -> else fail with error
+            if (!await Context.auth.canAccessGroup(model, PermissionLevel.Full)) {
+                throw new SimpleError({
+                    code: 'missing_permissions',
+                    message: 'You cannot restrict your own permissions',
+                    human: 'Je kan geen inschrijvingsgroep maken zonder dat je zelf volledige toegang hebt tot de nieuwe groep',
+                });
+            }
         }
 
         if (struct.waitingList) {
@@ -523,6 +528,7 @@ export class PatchOrganizationRegistrationPeriodsEndpoint extends Endpoint<Param
                     struct.waitingList,
                     model.organizationId,
                     period,
+                    { allowedIds: [struct.waitingList.id] },
                 );
                 model.waitingListId = group.id;
             }

package/src/helpers/AdminPermissionChecker.ts

@@ -195,11 +195,13 @@ export class AdminPermissionChecker {
         }
 
         // Check parent categories
-        const organizationPeriod = await this.getOrganizationCurrentPeriod(organization);
-        const parentCategories = group.getParentCategories(organizationPeriod.settings.categories);
-        for (const category of parentCategories) {
-            if (organizationPermissions.hasResourceAccess(PermissionsResourceType.GroupCategories, category.id, permissionLevel)) {
-                return true;
+        if (group.type === GroupType.Membership) {
+            const organizationPeriod = await this.getOrganizationCurrentPeriod(organization);
+            const parentCategories = group.getParentCategories(organizationPeriod.settings.categories);
+            for (const category of parentCategories) {
+                if (organizationPermissions.hasResourceAccess(PermissionsResourceType.GroupCategories, category.id, permissionLevel)) {
+                    return true;
+                }
             }
         }
 

package/src/services/FileSignService.ts

@@ -70,7 +70,9 @@ export class FileSignService {
                 if (e instanceof jose.errors.JWSSignatureVerificationFailed) {
                     return false;
                 }
-                console.error('Failed to verify file signature:', e);
+                if (STAMHOOFD.environment !== 'test') {
+                    console.error('Failed to verify file signature:', e);
+                }
                 return false;
             }
         };
@@ -120,15 +122,19 @@ export class FileSignService {
         }
     }
 
-    static async fillSignedUrlsForStruct(data: any) {
+    static async fillSignedUrlsForStruct(data: any, looped = new Set()) {
         if (data instanceof File) {
             return (await data.withSignedUrl()) ?? undefined; // never return null if it fails because we'll want to use the original file in that case
         }
+        if (looped.has(data)) {
+            return;
+        }
+        looped.add(data);
 
         if (Array.isArray(data)) {
             for (let i = 0; i < data.length; i++) {
                 const value = data[i];
-                const r = await this.fillSignedUrlsForStruct(value);
+                const r = await this.fillSignedUrlsForStruct(value, looped);
                 if (r !== undefined) {
                     data[i] = r;
                 }
@@ -138,7 +144,7 @@ export class FileSignService {
 
         if (data instanceof Map) {
             for (const [key, value] of data.entries()) {
-                const r = await this.fillSignedUrlsForStruct(value);
+                const r = await this.fillSignedUrlsForStruct(value, looped);
 
                 if (r !== undefined) {
                     data.set(key, r);
@@ -151,7 +157,7 @@ export class FileSignService {
         // Loop all keys and search for File objects + replace them with the signed variant
         if (typeof data === 'object' && data !== null) {
             for (const key in data) {
-                const r = await this.fillSignedUrlsForStruct(data[key]);
+                const r = await this.fillSignedUrlsForStruct(data[key], looped);
                 if (r !== undefined) {
                     data[key] = r;
                 }
@@ -160,7 +166,12 @@ export class FileSignService {
         }
     }
 
-    static async verifyFilesInStruct(data: any) {
+    static async verifyFilesInStruct(data: any, looped = new Set()) {
+        if (looped.has(data)) {
+            return;
+        }
+        looped.add(data);
+
         if (data instanceof File) {
             if (!data.isPrivate) {
                 return;
@@ -183,14 +194,14 @@ export class FileSignService {
 
         if (Array.isArray(data)) {
             for (const value of data) {
-                await this.verifyFilesInStruct(value);
+                await this.verifyFilesInStruct(value, looped);
             }
             return;
         }
 
         if (data instanceof Map) {
             for (const [key, value] of data.entries()) {
-                await this.verifyFilesInStruct(value);
+                await this.verifyFilesInStruct(value, looped);
             }
             return;
         }
@@ -198,7 +209,7 @@ export class FileSignService {
         // Loop all keys and search for File objects + replace them with the signed variant
         if (typeof data === 'object' && data !== null) {
             for (const key in data) {
-                await this.verifyFilesInStruct(data[key]);
+                await this.verifyFilesInStruct(data[key], looped);
             }
             return;
         }

package/tests/e2e/private-files.test.ts

@@ -7,6 +7,7 @@ import { PermissionLevel, Permissions } from '@stamhoofd/structures';
 import { PatchUserMembersEndpoint } from '../../src/endpoints/global/registration/PatchUserMembersEndpoint';
 import { testServer } from '../helpers/TestServer';
 import { GetUserMembersEndpoint } from '../../src/endpoints/global/registration/GetUserMembersEndpoint';
+import { FileSignService } from '../../src/services/FileSignService';
 
 const baseUrl = `/v${Version}/members`;
 const endpoint = new PatchUserMembersEndpoint();
@@ -413,6 +414,181 @@ describe('E2E.PrivateFiles', () => {
         expect(answer.file!.signedUrl).not.toEqual('https://test.com/test.exe'); // It got replaced with a proper signed url
     });
 
+    describe('fillSignedUrlsForStruct', () => {
+        test('Can handle circular references', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+            await privateFile.sign();
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    data: {
+                        here: null as any,
+                    },
+                    file: privateFile,
+                },
+            };
+
+            data.circular.data.here = data;
+
+            await FileSignService.fillSignedUrlsForStruct(data);
+            expect(data.circular.file.signedUrl).toBeString();
+        });
+
+        test('Can handle duplicate files', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+            await privateFile.sign();
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    file1: privateFile,
+                    file2: privateFile,
+                },
+                arr: [
+                    privateFile,
+                    privateFile,
+                ],
+            };
+
+            await FileSignService.fillSignedUrlsForStruct(data);
+            expect(data.circular.file1.signedUrl).toBeString();
+            expect(data.circular.file2.signedUrl).toBeString();
+            expect(data.arr[0].signedUrl).toBeString();
+            expect(data.arr[1].signedUrl).toBeString();
+        });
+    });
+
+    describe('verifyFilesInStruct', () => {
+        test('Can handle circular references that are properly signed', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+            await privateFile.sign();
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    data: {
+                        here: null as any,
+                    },
+                    file: privateFile,
+                },
+            };
+
+            data.circular.data.here = data;
+
+            await expect(FileSignService.verifyFilesInStruct(data)).toResolve();
+        });
+
+        test('Can handle duplicate files that are properly signed', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+            await privateFile.sign();
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    file1: privateFile,
+                    file2: privateFile,
+                },
+                arr: [
+                    privateFile,
+                    privateFile,
+                ],
+            };
+
+            await expect(FileSignService.verifyFilesInStruct(data)).toResolve();
+        });
+
+        test('Can handle circular references with files that are not signed', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    data: {
+                        here: null as any,
+                    },
+                    file: privateFile,
+                },
+            };
+
+            data.circular.data.here = data;
+
+            await expect(FileSignService.verifyFilesInStruct(data)).rejects.toThrow(/Invalid signature for file/);
+        });
+
+        test('Can handle duplicate files that are not signed', async () => {
+            // A malicious user could try to set a private file to a member in order to get
+            // access to the signed URL. This should not be possible without a valid signature
+            const privateFile = new File({
+                id: 'test',
+                server: 'test.com',
+                path: 'test.txt',
+                size: 100,
+                isPrivate: true,
+            });
+
+            const data = {
+                hello: 'true',
+                world: 'false',
+                circular: {
+                    file1: privateFile,
+                    file2: privateFile,
+                },
+                arr: [
+                    privateFile,
+                    privateFile,
+                ],
+            };
+
+            await expect(FileSignService.verifyFilesInStruct(data)).rejects.toThrow(/Invalid signature for file/);
+        });
+    });
+
     /**
      * Tests that when an unverified file is stored on the server with a signed url, the server will never return that signed url.
      */