apostrophe 4.31.0 → 4.32.0

package/test/pieces-public-api-relationship-choices.js

@@ -0,0 +1,245 @@
+const t = require('../test-lib/test.js');
+const assert = require('assert');
+
+// A blocked filter contributes no entry (or an empty array) to the
+// choices/counts bag the REST API returns.
+function assertNoLeak(bag, key, message) {
+  assert(!bag || !bag[key] || bag[key].length === 0, message);
+}
+
+// Regression tests for GHSA-xmpp-f9v3-r7qh — the incomplete fix for
+// CVE-2026-39857. The projection guard that stops `?choices=` / `?counts=`
+// from leaking distinct values of fields excluded from `publicApiProjection`
+// resolved the schema field by an EXACT-NAME match. Relationship fields
+// register additional query builders whose names differ from the schema field
+// name — the "slug" alias builders (`author` / `authorAnd` for a relationship
+// field named `_author`) and the `_authorAnd` operation builder. Because none
+// of those names match `_author` exactly, the guard failed open and an
+// unauthenticated caller could still extract the relationship's distinct
+// choices (referenced, publicly-visible related docs by title/slug, plus
+// per-value counts via `?counts=`).
+
+describe('Pieces Public API — relationship choices/counts projection guard (GHSA-xmpp-f9v3-r7qh)', function() {
+
+  let apos;
+
+  this.timeout(t.timeout);
+
+  after(async function () {
+    return t.destroy(apos);
+  });
+
+  it('should initialize with article + author piece types', async function() {
+    apos = await t.create({
+      root: module,
+      modules: {
+        author: {
+          extend: '@apostrophecms/piece-type',
+          options: {
+            alias: 'author',
+            label: 'Author'
+          }
+        },
+        article: {
+          extend: '@apostrophecms/piece-type',
+          options: {
+            alias: 'article',
+            label: 'Article'
+          },
+          fields: {
+            add: {
+              foo: {
+                label: 'Foo',
+                type: 'string'
+              },
+              // Deliberately named with a leading underscore, as recommended.
+              // Its slug-alias builders are `author` / `authorAnd`; its
+              // operation builders are `_author` / `_authorAnd`.
+              _author: {
+                label: 'Author',
+                type: 'relationship',
+                withType: 'author'
+              }
+            }
+          }
+        }
+      }
+    });
+    assert(apos.modules.article);
+    assert(apos.modules.author);
+
+    // Sanity: confirm the relationship registered the extra query builders
+    // whose names differ from the `_author` schema field name. These are the
+    // aliases the guard must also gate.
+    const builders = apos.article.find(apos.task.getReq()).builders;
+    assert(builders._author, 'expected relationship builder "_author"');
+    assert(builders._authorAnd, 'expected relationship builder "_authorAnd"');
+    assert(builders.author, 'expected relationship slug-alias builder "author"');
+    assert(builders.authorAnd, 'expected relationship slug-alias builder "authorAnd"');
+  });
+
+  let jane;
+
+  it('should insert a public author and a public article that references it', async function() {
+    const req = apos.task.getReq();
+    jane = await apos.author.insert(req, {
+      ...apos.author.newInstance(),
+      title: 'Jane Author',
+      visibility: 'public'
+    });
+    await apos.article.insert(req, {
+      ...apos.article.newInstance(),
+      title: 'My Article',
+      foo: 'bar',
+      visibility: 'public',
+      _author: [ jane ]
+    });
+
+    // Confirm the relationship persisted so that, absent the guard, the
+    // distinct-values leak would actually have data to expose. This is what
+    // makes the "must not leak" assertions below meaningful.
+    const article = await apos.article.find(req, { title: 'My Article' }).toObject();
+    assert(article);
+    assert(Array.isArray(article._author) && article._author.length === 1);
+    assert.strictEqual(article._author[0].title, 'Jane Author');
+    assert(Array.isArray(article.authorIds) && article.authorIds.length === 1);
+  });
+
+  it('baseline: an anonymous list with a projection excluding _author does not expose the relationship', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article');
+    assert(response);
+    assert(response.results);
+    assert.strictEqual(response.results.length, 1);
+    assert.strictEqual(response.results[0].title, 'My Article');
+    // The relationship must not be populated, and its idsStorage must not be
+    // exposed, when excluded from the projection. (An excluded relationship
+    // comes back as an empty array, so check length rather than truthiness.)
+    assert(
+      !response.results[0]._author || response.results[0]._author.length === 0,
+      '_author must not be populated when excluded from publicApiProjection'
+    );
+    assert(!response.results[0].authorIds, 'authorIds must not be exposed when excluded from publicApiProjection');
+  });
+
+  // Positive control: this proves the relationship choices machinery works and
+  // that the referenced author is discoverable — so the "must not leak" tests
+  // that follow (with the SAME data, only the projection changed) genuinely
+  // demonstrate the guard is doing the blocking, not an absence of data.
+  it('when _author IS in the publicApiProjection, ?choices=author returns the related choices', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1,
+      _author: 1
+    };
+    const response = await apos.http.get('/api/v1/article?choices=author');
+    assert(response);
+    assert(response.choices);
+    assert(Array.isArray(response.choices.author));
+    assert(
+      response.choices.author.some(c => c.label === 'Jane Author'),
+      'expected the related author among the choices when the relationship is projected'
+    );
+    // The slug alias exposes the related doc slug as the choice value.
+    assert(response.choices.author.some(c => c.value === jane.slug));
+  });
+
+  it('SECURITY: ?choices=author must not leak choices for a relationship excluded from publicApiProjection', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article?choices=author');
+    assert(response);
+    assertNoLeak(
+      response.choices,
+      'author',
+      'relationship slug-alias choices for excluded field "_author" must not be exposed publicly via ?choices=author'
+    );
+  });
+
+  it('SECURITY: ?choices=authorAnd must not leak choices for a relationship excluded from publicApiProjection', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article?choices=authorAnd');
+    assert(response);
+    assertNoLeak(
+      response.choices,
+      'authorAnd',
+      'relationship slug-alias choices for excluded field "_author" must not be exposed publicly via ?choices=authorAnd'
+    );
+  });
+
+  it('SECURITY: ?choices=_authorAnd must not leak choices for a relationship excluded from publicApiProjection', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article?choices=_authorAnd');
+    assert(response);
+    assertNoLeak(
+      response.choices,
+      '_authorAnd',
+      'relationship operation-builder choices for excluded field "_author" must not be exposed publicly via ?choices=_authorAnd'
+    );
+  });
+
+  it('SECURITY: ?counts=author must not leak counts for a relationship excluded from publicApiProjection', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article?counts=author');
+    assert(response);
+    assertNoLeak(
+      response.counts,
+      'author',
+      'relationship slug-alias counts for excluded field "_author" must not be exposed publicly via ?counts=author'
+    );
+  });
+
+  // Regression guard: the exact-name case was already blocked by the parent
+  // CVE fix and must stay blocked.
+  it('?choices=_author (exact relationship field name) remains blocked when excluded from publicApiProjection', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article?choices=_author');
+    assert(response);
+    assertNoLeak(
+      response.choices,
+      '_author',
+      'relationship choices for excluded field "_author" must not be exposed publicly'
+    );
+  });
+
+  // The guard is a public-API protection only; authenticated full-API callers
+  // (no publicApiProjection applied) must still receive relationship choices.
+  it('authenticated full-API callers still receive relationship choices for a non-projected relationship', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const req = apos.task.getReq();
+    const query = apos.article.find(req).choices([ 'author' ]);
+    await query.toArray();
+    const choices = query.get('choicesResults');
+    assert(choices);
+    assert(choices.author);
+    assert(choices.author.some(c => c.label === 'Jane Author'));
+  });
+});

package/test/pieces.js

@@ -6,6 +6,12 @@ const _ = require('lodash');
 const FormData = require('form-data');
 const t = require('../test-lib/test.js');
 
+// The etag tests below issue their conditional request via rawGet (raw
+// node:http): the built-in fetch used by apos.http adds Cache-Control: no-cache
+// to any request carrying a conditional header (Fetch standard), which would
+// suppress the asserted 304s.
+const { rawGet } = t;
+
 describe('Pieces', function() {
 
   let apos;
@@ -1807,11 +1813,8 @@ describe('Pieces', function() {
     };
 
     const response1 = await apos.http.get('/api/v1/thing/testThing:en:published', { fullResponse: true });
-    const response2 = await apos.http.get('/api/v1/thing/testThing:en:published', {
-      fullResponse: true,
-      headers: {
-        'if-none-match': response1.headers.etag
-      }
+    const response2 = await rawGet(apos, '/api/v1/thing/testThing:en:published', {
+      'if-none-match': response1.headers.etag
     });
 
     assert(response1.status === 200);
@@ -1845,11 +1848,8 @@ describe('Pieces', function() {
     // so requesting it again should not return a 304 status code
     const pieceUpdateResponse = await apos.doc.update(apos.task.getReq(), pieceDoc);
 
-    const response2 = await apos.http.get('/api/v1/thing/testThing:en:published', {
-      fullResponse: true,
-      headers: {
-        'if-none-match': response1.headers.etag
-      }
+    const response2 = await rawGet(apos, '/api/v1/thing/testThing:en:published', {
+      'if-none-match': response1.headers.etag
     });
 
     const eTag1Parts = response1.headers.etag.split(':');
@@ -1885,11 +1885,8 @@ describe('Pieces', function() {
     outOfDateETagParts[2] = Number(outOfDateETagParts[2]) -
       (4444 + 1) * 1000; // 1s outdated
 
-    const response2 = await apos.http.get('/api/v1/thing/testThing:en:published', {
-      fullResponse: true,
-      headers: {
-        'if-none-match': outOfDateETagParts.join(':')
-      }
+    const response2 = await rawGet(apos, '/api/v1/thing/testThing:en:published', {
+      'if-none-match': outOfDateETagParts.join(':')
     });
 
     const eTag1Parts = response1.headers.etag.split(':');

package/test-lib/test.js

@@ -1,5 +1,6 @@
 const fs = require('fs-extra');
 const path = require('path');
+const http = require('node:http');
 
 const setupPackages = ({ folder = 'test' }) => {
   const testNodeModules = path.join(__dirname, '../', folder, 'node_modules/');
@@ -57,5 +58,36 @@ const setupPackages = ({ folder = 'test' }) => {
 };
 setupPackages({ folder: 'test' });
 
+// Performs a GET via the raw node:http client, sending `headers` to the server
+// verbatim. Use this in tests that must control headers the built-in fetch
+// (used by apos.http) would otherwise refuse or rewrite: e.g. a forbidden
+// `Host` header, or the `Cache-Control: no-cache` it adds to any request that
+// carries a conditional header (If-None-Match / If-Modified-Since). `url` may
+// be absolute or site-relative (resolved against `apos.http.getBase()`).
+// Resolves with a fullResponse-shaped { status, headers, body }.
+const rawGet = (apos, url, headers = {}) => {
+  const target = url.startsWith('/') ? `${apos.http.getBase()}${url}` : url;
+  return new Promise((resolve, reject) => {
+    // Pass the URL string (rather than a split hostname/port) so an IPv6 base
+    // such as `http://[::1]:3000` from getBase() is handled correctly; a
+    // bracketed hostname passed on its own is treated as a name to DNS-resolve.
+    const req = http.request(target, {
+      method: 'GET',
+      headers
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (chunk) => chunks.push(chunk));
+      res.on('end', () => resolve({
+        status: res.statusCode,
+        headers: res.headers,
+        body: Buffer.concat(chunks).toString()
+      }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+};
+
 module.exports = require('./util.js');
 module.exports.setupPackages = setupPackages;
+module.exports.rawGet = rawGet;