sharedb 6.0.2 → 6.0.3

package/lib/client/doc.js

@@ -1,5 +1,6 @@
 var emitter = require('../emitter');
 var logger = require('../logger');
+var ot = require('../ot');
 var ShareDBError = require('../error');
 var types = require('../types');
 var util = require('../util');
@@ -599,6 +600,9 @@ Doc.prototype._otApply = function(op, source) {
       );
     }
 
+    var pathError = ot.checkOpPathsForType(this.type, op);
+    if (pathError) throw pathError;
+
     // NB: If we need to add another argument to this event, we should consider
     // the fact that the 'op' event has op.src as its 3rd argument
     this.emit('before op batch', op.op, source);
@@ -765,6 +769,14 @@ Doc.prototype._submit = function(op, source, callback) {
     }
     // Try to normalize the op. This removes trailing skip:0's and things like that.
     if (this.type.normalize) op.op = this.type.normalize(op.op);
+
+    // This has to happen before _pushOp(), because _tryCompose() applies the op
+    // to a pending create, well before _otApply() gets a chance to check it
+    var pathError = ot.checkOpPathsForType(this.type, op);
+    if (pathError) {
+      if (callback) return callback(pathError);
+      return this.emit('error', pathError);
+    }
   }
 
   try {

package/lib/ot.js

@@ -108,18 +108,9 @@ function applyOpEdit(snapshot, edit) {
   var type = types.map[snapshot.type];
   if (!type) return new ShareDBError(ERROR_CODE.ERR_DOC_TYPE_NOT_RECOGNIZED, 'Unknown type');
 
-  if (type.name === 'json0' && Array.isArray(edit)) {
-    for (var i = 0; i < edit.length; i++) {
-      var opComponent = edit[i];
-      if (Array.isArray(opComponent.p)) {
-        for (var j = 0; j < opComponent.p.length; j++) {
-          var pathSegment = opComponent.p[j];
-          if (util.isDangerousProperty(pathSegment)) {
-            return new ShareDBError(ERROR_CODE.ERR_OT_OP_NOT_APPLIED, 'Invalid path segment');
-          }
-        }
-      }
-    }
+  if (type.name === 'json0') {
+    var pathError = checkJson0OpPaths(edit);
+    if (pathError) return pathError;
   }
 
   try {
@@ -129,6 +120,32 @@ function applyOpEdit(snapshot, edit) {
   }
 }
 
+// ot-json0 walks ops with .length and numeric indexing, so it treats array-like
+// objects as ops too, and it coerces .length. This traversal has to match it
+// exactly: anything ot-json0 will apply has to be checked here.
+// See GHSA-9rqw-j2q5-gg2g
+function checkJson0OpPaths(op) {
+  if (op == null) return;
+  for (var i = 0; i < op.length; i++) {
+    var component = op[i];
+    // ot-json0's checkValidOp() rejects the whole op before applying any of it,
+    // so there is nothing beyond this component left to check
+    if (!component || typeof component !== 'object' || !Array.isArray(component.p)) return;
+    for (var j = 0; j < component.p.length; j++) {
+      if (util.isDangerousProperty(component.p[j])) {
+        return new ShareDBError(ERROR_CODE.ERR_OT_OP_NOT_APPLIED, 'Invalid path segment');
+      }
+    }
+  }
+}
+
+exports.checkOpPathsForType = function(type, op) {
+  if (!('op' in op)) return;
+  if (typeof type === 'string') type = types.map[type];
+  if (!type || type.name !== 'json0') return;
+  return checkJson0OpPaths(op.op);
+};
+
 exports.transform = function(type, op, appliedOp) {
   // There are 16 cases this function needs to deal with - which are all the
   // combinations of create/delete/op/noop from both op and appliedOp
@@ -178,6 +195,10 @@ exports.applyOps = function(snapshot, ops, options) {
   options = options || {};
   for (var index = 0; index < ops.length; index++) {
     var op = ops[index];
+    // normalizeLegacyJson0Ops() applies op components itself, so paths have to
+    // be checked before it runs, not just in exports.apply()
+    var pathError = exports.checkOpPathsForType(snapshot.type, op);
+    if (pathError) return pathError;
     if (options._normalizeLegacyJson0Ops) {
       try {
         normalizeLegacyJson0Ops(snapshot, op);

package/lib/projections.js

@@ -58,7 +58,7 @@ function projectEdit(fields, op) {
       }
     } else {
       // The path has a first element. Just check it against the fields.
-      if (fields[path[0]]) {
+      if (isFieldAllowed(fields, path[0])) {
         result.push(c);
       }
     }
@@ -91,7 +91,7 @@ function isSnapshotAllowed(fields, snapshot) {
     return false;
   }
   for (var k in snapshot.data) {
-    if (!fields[k]) return false;
+    if (!isFieldAllowed(fields, k)) return false;
   }
   return true;
 }
@@ -101,13 +101,17 @@ function isEditAllowed(fields, op) {
     var c = op[i];
     if (c.p.length === 0) {
       return false;
-    } else if (!fields[c.p[0]]) {
+    } else if (!isFieldAllowed(fields, c.p[0])) {
       return false;
     }
   }
   return true;
 }
 
+function isFieldAllowed(fields, field) {
+  return util.hasOwn(fields, field) && !!fields[field];
+}
+
 function projectData(fields, data) {
   // Return back null or undefined
   if (data == null) {

package/lib/util.js

@@ -100,14 +100,13 @@ exports.clone = function(obj) {
   return (obj === undefined) ? undefined : JSON.parse(JSON.stringify(obj));
 };
 
+// A null prototype makes '__proto__' an ordinary own key, so it can be in the map
 var objectProtoPropNames = Object.create(null);
 Object.getOwnPropertyNames(Object.prototype).forEach(function(prop) {
-  if (prop !== '__proto__') {
-    objectProtoPropNames[prop] = true;
-  }
+  objectProtoPropNames[prop] = true;
 });
 exports.isDangerousProperty = function(propName) {
-  return propName === '__proto__' || objectProtoPropNames[propName];
+  return objectProtoPropNames[propName] === true;
 };
 
 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sharedb",
-  "version": "6.0.2",
+  "version": "6.0.3",
   "description": "JSON OT database backend",
   "main": "lib/index.js",
   "dependencies": {
@@ -15,7 +15,7 @@
     "chai": "^6.2.2",
     "eslint": "^10.1.0",
     "eslint-config-google": "^0.14.0",
-    "mocha": "^11.7.5",
+    "mocha": "^12.0.0",
     "nyc": "^18.0.0",
     "ot-json0-v2": "https://github.com/ottypes/json0#90a3ae26364c4fa3b19b6df34dad46707a704421",
     "ot-json1": "^1.0.2",

package/test/client/doc.js

@@ -682,6 +682,10 @@ describe('Doc', function() {
       });
     }
 
+    afterEach(function() {
+      delete Object.prototype.polluted;
+    });
+
     ['__proto__', 'constructor'].forEach(function(badProp) {
       it('Rejects ops with collection ' + badProp, function(done) {
         var collectionName = badProp;
@@ -755,6 +759,177 @@ describe('Doc', function() {
         });
       });
     });
+
+    // ot-json0 walks ops with .length and numeric indexing, so it applies an
+    // array-like object as if it were an op
+    [
+      {
+        name: 'an array-like op',
+        op: {0: {p: ['__proto__', 'polluted'], oi: 'oops'}, length: 1}
+      },
+      {
+        name: 'ops with a path segment that is not a string',
+        op: [{p: [['__proto__'], 'polluted'], oi: 'oops'}]
+      }
+    ].forEach(function(test) {
+      it('Rejects ' + test.name, function(done) {
+        var connection = this.connection;
+        var collectionName = 'test-collection';
+        var docId = 'test-doc';
+        connection.get(collectionName, docId).create({id: docId}, function(err) {
+          if (err) {
+            return done(err);
+          }
+          expectReceiveError(connection, collectionName, docId, 'Invalid path segment', function(error) {
+            if (error) {
+              return done(error);
+            }
+            expect({}.polluted).to.equal(undefined);
+            done();
+          });
+          connection.send({
+            a: 'op',
+            c: collectionName,
+            d: docId,
+            v: 1,
+            seq: connection.seq++,
+            x: {},
+            op: test.op
+          });
+        });
+      });
+    });
+
+    function expectInvalidPathSegment(error) {
+      expect(error.code).to.equal(ShareDBError.CODES.ERR_OT_OP_NOT_APPLIED);
+      expect(error.message).to.equal('Invalid path segment');
+      expect({}.polluted).to.equal(undefined);
+    }
+
+    describe('ops from the server', function() {
+      var multiComponentOp = [{p: ['baz'], oi: true}, {p: ['__proto__', 'polluted'], oi: 'oops'}];
+      var connection;
+      var doc;
+
+      beforeEach(function(done) {
+        connection = this.connection;
+        doc = connection.get('test-collection', 'test-doc');
+        doc.create({foo: 'bar'}, done);
+      });
+
+      function sendOp(op) {
+        connection.handleMessage({
+          a: 'op',
+          c: doc.collection,
+          d: doc.id,
+          v: 1,
+          src: 'hostile',
+          seq: 1,
+          op: op
+        });
+      }
+
+      [
+        {
+          name: 'ops with a dangerous first path segment',
+          op: [{p: ['__proto__', 'polluted'], oi: 'oops'}]
+        },
+        {
+          name: 'ops with a dangerous later path segment',
+          op: [{p: ['foo', 'constructor'], oi: 'oops'}]
+        },
+        {
+          name: 'an array-like op',
+          op: {0: {p: ['__proto__', 'polluted'], oi: 'oops'}, length: 1}
+        },
+        {
+          name: 'ops with a path segment that is not a string',
+          op: [{p: [['__proto__'], 'polluted'], oi: 'oops'}]
+        },
+        {
+          name: 'multi-component ops',
+          op: multiComponentOp
+        }
+      ].forEach(function(test) {
+        it('Rejects ' + test.name, function(done) {
+          doc.on('error', function(error) {
+            expectInvalidPathSegment(error);
+            done();
+          });
+          sendOp(test.op);
+        });
+      });
+
+      it('does not apply the valid components of a rejected multi-component op', function(done) {
+        doc.on('error', function() {
+          expect(doc.data).to.not.have.property('baz');
+          done();
+        });
+        sendOp(multiComponentOp);
+      });
+
+      it('leaves the doc usable after rejecting an op', function(done) {
+        doc.on('error', function() {
+          async.series([
+            doc.submitOp.bind(doc, [{p: ['baz'], oi: true}]),
+            doc.whenNothingPending.bind(doc),
+            function(next) {
+              expect(doc.data).to.eql({foo: 'bar', baz: true});
+              next();
+            }
+          ], done);
+        });
+        sendOp(multiComponentOp);
+      });
+    });
+
+    describe('locally submitted ops', function() {
+      var badOp = [{p: ['__proto__', 'polluted'], oi: 'oops'}];
+
+      it('rejects an op composed into a pending create', function(done) {
+        var doc = this.connection.get('test-collection', 'test-doc');
+        doc.create({foo: 'bar'});
+        doc.submitOp(badOp, function(error) {
+          expectInvalidPathSegment(error);
+          done();
+        });
+      });
+
+      it('rejects an op without sending it to the server', function(done) {
+        var doc = this.connection.get('test-collection', 'test-doc');
+        doc.create({foo: 'bar'}, function(error) {
+          if (error) return done(error);
+          var calledBack = false;
+          doc.submitOp(badOp, function(error) {
+            calledBack = true;
+            expectInvalidPathSegment(error);
+          });
+          // The server would only reject asynchronously, so calling back
+          // synchronously is how we know the op never left the client
+          expect(calledBack).to.equal(true);
+          done();
+        });
+      });
+
+      it('leaves the doc usable after rejecting an op', function(done) {
+        var doc = this.connection.get('test-collection', 'test-doc');
+        async.series([
+          doc.create.bind(doc, {foo: 'bar'}),
+          function(next) {
+            doc.submitOp(badOp, function(error) {
+              expect(error).to.be.instanceOf(Error);
+              next();
+            });
+          },
+          doc.submitOp.bind(doc, [{p: ['baz'], oi: true}]),
+          doc.whenNothingPending.bind(doc),
+          function(next) {
+            expect(doc.data).to.eql({foo: 'bar', baz: true});
+            next();
+          }
+        ], done);
+      });
+    });
   });
 
   describe('toSnapshot', function() {

package/test/ot.js

@@ -125,6 +125,68 @@ describe('ot', function() {
     });
   });
 
+  describe('json0 op validation', function() {
+    var snapshot;
+
+    beforeEach(function() {
+      snapshot = {v: 6, type: type.uri, data: {colour: 'blue'}};
+    });
+
+    afterEach(function() {
+      delete Object.prototype.polluted;
+    });
+
+    it('does not pollute the prototype through an array-like op', function() {
+      var op = {0: {p: ['__proto__', 'polluted'], oi: 'yes'}, length: 1};
+      var error = ot.apply(snapshot, {v: 6, op: op});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+      expect(error.message).to.equal('Invalid path segment');
+      expect({}.polluted).to.equal(undefined);
+    });
+
+    it('does not pollute the prototype through an array-like op with a string length', function() {
+      var op = {0: {p: ['__proto__', 'polluted'], oi: 'yes'}, length: '1'};
+      var error = ot.apply(snapshot, {v: 6, op: op});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+      expect(error.message).to.equal('Invalid path segment');
+      expect({}.polluted).to.equal(undefined);
+    });
+
+    it('does not pollute the prototype through a path segment that is not a string', function() {
+      var error = ot.apply(snapshot, {v: 6, op: [{p: [['__proto__'], 'polluted'], oi: 'yes'}]});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+      expect(error.message).to.equal('Invalid path segment');
+      expect({}.polluted).to.equal(undefined);
+    });
+
+    ['__proto__', 'constructor'].forEach(function(badProp) {
+      it('rejects ' + badProp + ' as a path segment', function() {
+        var error = ot.apply(snapshot, {v: 6, op: [{p: [badProp, 'polluted'], oi: 'yes'}]});
+        expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+        expect(error.message).to.equal('Invalid path segment');
+        expect({}.polluted).to.equal(undefined);
+      });
+    });
+
+    it('returns an error for an op component that is not an object', function() {
+      var error;
+      expect(function() {
+        error = ot.apply(snapshot, {v: 6, op: [null]});
+      }).to.not.throw();
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+    });
+
+    it('returns an error for an array-like op whose components are missing', function() {
+      var error = ot.apply(snapshot, {v: 6, op: {length: 1e9}});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+    });
+
+    it('accepts an op that ot-json0 treats as a no-op', function() {
+      expect(ot.apply(snapshot, {v: 6, op: {p: ['colour'], oi: 'red'}})).equal();
+      expect(snapshot).to.eql({v: 7, type: type.uri, data: {colour: 'blue'}});
+    });
+  });
+
   describe('no-op', function() {
     it('works on existing docs', function() {
       var doc = {v: 6, type: type.uri, data: 'Hi'};
@@ -374,6 +436,55 @@ describe('ot', function() {
 
   describe('applyOps', function() {
     describe('with normalization turned on', function() {
+      afterEach(function() {
+        delete Object.prototype.polluted;
+      });
+
+      it('does not pollute the prototype while normalizing a legacy op', function() {
+        var snapshot = {
+          type: 'http://sharejs.org/types/JSONv0',
+          data: {title: 'Wee Free Men'}
+        };
+
+        var ops = [
+          {
+            v: 1,
+            op: [
+              {p: ['__proto__', 'polluted'], oi: 'yes'},
+              {p: ['title'], od: 'Wee Free Men', oi: 'Nation'}
+            ]
+          }
+        ];
+
+        var error = ot.applyOps(snapshot, ops, {
+          _normalizeLegacyJson0Ops: true
+        });
+        expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+        expect(error.message).to.equal('Invalid path segment');
+        expect({}.polluted).to.equal(undefined);
+      });
+
+      it('replays a legacy op that ot-json0 treats as a no-op', function() {
+        var snapshot = {
+          type: 'http://sharejs.org/types/JSONv0',
+          data: {title: 'Wee Free Men'}
+        };
+
+        var ops = [
+          {
+            v: 1,
+            op: {p: ['title'], od: 'Wee Free Men', oi: 'Nation'}
+          }
+        ];
+
+        var error = ot.applyOps(snapshot, ops, {
+          _normalizeLegacyJson0Ops: true
+        });
+        expect(error).to.be.undefined;
+        expect(snapshot.data).to.eql({title: 'Wee Free Men'});
+        expect(snapshot.v).to.equal(2);
+      });
+
       it('applies an op to a snapshot', function() {
         var snapshot = {
           type: 'http://sharejs.org/types/JSONv0',

package/test/projections.js

@@ -385,4 +385,33 @@ describe('projection utility methods', function() {
       );
     });
   });
+
+  describe('non-truthy field values', function() {
+    it('does not treat a false field as a projected field', function() {
+      var op = {op: [{p: ['x', 'y'], oi: 'nope'}]};
+      expect(projections.isOpAllowed(null, {x: false}, op)).equal(false);
+      projections.projectOp({x: false}, op);
+      expect(op).eql({op: []});
+    });
+
+    it('does not treat a false field as an allowed snapshot field', function() {
+      expect(projections.isSnapshotAllowed({x: false}, {type: type, data: {x: 1}})).equal(false);
+    });
+  });
+
+  describe('field names inherited from Object.prototype', function() {
+    ['__proto__', 'constructor', 'toString'].forEach(function(badProp) {
+      it('does not treat ' + badProp + ' as a projected field', function() {
+        var op = {op: [{p: [badProp, 'x'], oi: 'oops'}]};
+        expect(projections.isOpAllowed(null, {x: true}, op)).equal(false);
+        projections.projectOp({x: true}, op);
+        expect(op).eql({op: []});
+      });
+
+      it('does not treat ' + badProp + ' as an allowed snapshot field', function() {
+        var data = JSON.parse('{"' + badProp + '": "oops"}');
+        expect(projections.isSnapshotAllowed({x: true}, {type: type, data: data})).equal(false);
+      });
+    });
+  });
 });