@vulkano/core 1.24.0 → 1.24.2

package/database/scaffold.js

@@ -1,5 +1,67 @@
+// Field names that are never exposed through populate select, whatever the
+// caller asks for — a coarse, name-based backstop for common secret-shaped
+// fields (defense in depth on top of the schema's own `select: false`, in
+// case a referenced model forgets to mark a sensitive field itself).
+const SENSITIVE_FIELD_HINTS = [
+  'password', 'passwd', 'secret', 'token', 'apikey', 'api_key',
+  'privatekey', 'private_key', 'hash', 'salt', 'ssn', 'creditcard',
+  'credit_card', 'cvv', 'pin'
+];
+
+function isSensitiveByName(field) {
+  const lower = field.toLowerCase();
+  return SENSITIVE_FIELD_HINTS.some((hint) => lower.includes(hint));
+}
+
 module.exports = {
 
+  /**
+   * Look up the referenced model on the same connection this model was
+   * compiled on (models here are registered via `db.model(...)`, not the
+   * global `mongoose.model(...)` registry — see database/mongodb.js — so
+   * resolving by connection is required for this to ever find it).
+   *
+   * @param {String} refModelName mongoose ref (the "ref" schema option)
+   * @returns {Object|null}
+   */
+  _resolveRefModel(refModelName) {
+
+    try {
+      return (this.db && this.db.model(refModelName)) || mongoose.model(refModelName);
+    } catch {
+      return null;
+    }
+
+  },
+
+  /**
+   * A field is safe to expose through populate select when it's neither
+   * name-flagged as sensitive (SENSITIVE_FIELD_HINTS) nor marked
+   * `select: false` on the REFERENCED model's own schema. If the referenced
+   * model can't be resolved (e.g. in isolated unit tests), only the
+   * name-based check applies.
+   *
+   * @param {String} refModelName mongoose ref (the "ref" schema option)
+   * @param {String} field
+   * @returns {Boolean}
+   */
+  _isFieldSafeToExpose(refModelName, field) {
+
+    if (isSensitiveByName(field)) {
+      return false;
+    }
+
+    const RefModel = this._resolveRefModel(refModelName);
+    const refPath = RefModel && RefModel.schema.paths[field];
+
+    if (refPath && refPath.options && refPath.options.select === false) {
+      return false;
+    }
+
+    return true;
+
+  },
+
   /**
    * Parse the populate param into one entry per relation: `name` (trimmed,
    * lowercased) plus an optional `fields` list. Syntax: relations are
@@ -103,7 +165,28 @@ module.exports = {
         const populateProps = { path: field };
 
         if (entry.fields && entry.fields.length > 0) {
-          populateProps.select = entry.fields.join(' ');
+
+          // Explicit field list: keep only what's safe, as a pure inclusion
+          // select. If everything requested turns out sensitive, fall back
+          // to "_id" only — never to the unfiltered full document.
+          const safeFields = entry.fields.filter((f) => this._isFieldSafeToExpose(ref, f));
+          populateProps.select = safeFields.length > 0 ? safeFields.join(' ') : '_id';
+
+        } else {
+
+          // Full-doc populate: still must not leak sensitive fields, so
+          // build an exclusion select for whatever the ref schema/name-hints
+          // flag on that model — skipped only if nothing needs excluding.
+          const RefModel = this._resolveRefModel(ref);
+
+          const toExclude = RefModel
+            ? Object.keys(RefModel.schema.paths).filter((f) => !this._isFieldSafeToExpose(ref, f))
+            : [];
+
+          if (toExclude.length > 0) {
+            populateProps.select = toExclude.map((f) => `-${f}`).join(' ');
+          }
+
         }
 
         return populateProps;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vulkano/core",
-  "version": "1.24.0",
+  "version": "1.24.2",
   "description": "A MVC framework using Express 4",
   "license": "MIT",
   "author": "Vulkano Team",

package/views/helpers/t.js

@@ -0,0 +1,12 @@
+/**
+ * Exposes i18next translation as a view helper.
+ * Not the raw `i18n` global: Handlebars helpers must be callable functions,
+ * not objects with methods — {{ i18n.t('key') }} works in Nunjucks but
+ * throws in Handlebars ("fn is not a function") since its helper wrapper
+ * invokes whatever is registered directly.
+ *
+ * Usage:
+ *   Nunjucks:   {{ t('key') }}
+ *   Handlebars: {{t "key"}}
+ */
+module.exports = (key, options) => i18n.t(key, options);