mirror of
https://github.com/seerr-team/seerr.git
synced 2026-10-12 02:22:17 +00:00
User.settings is an eager relation, so it rode along into every response embedding a User, exposing pushover, pushbullet, telegram, discord and PGP values through the request, issue, issue comment, blocklist, and watchlist endpoints. It now omits it by using User.toJSON(). GET /auth/me builds settings from seven non-credential fields the web app reads, so locale and region defaults keep working. Reported as a security advisory, GHSA-8j73-j6rc-q8xh.
53 lines
1.4 KiB
TypeScript
53 lines
1.4 KiB
TypeScript
import { getRepository } from '@server/datasource';
|
|
import { User } from '@server/entity/User';
|
|
import { UserSettings } from '@server/entity/UserSettings';
|
|
import assert from 'node:assert/strict';
|
|
|
|
const credentials = {
|
|
pgpKey: 'test-pgp-key',
|
|
discordIds: ['112233445566'],
|
|
pushbulletAccessToken: 'test-pushbullet-token',
|
|
pushoverApplicationToken: 'test-pushover-app-token',
|
|
pushoverUserKey: 'test-pushover-user-key',
|
|
telegramChatId: '-1001234567',
|
|
};
|
|
|
|
export const allowlistedSettings = {
|
|
locale: 'de',
|
|
discoverRegion: 'DE',
|
|
streamingRegion: 'DE',
|
|
originalLanguage: 'de',
|
|
watchlistSyncMovies: true,
|
|
watchlistSyncTv: false,
|
|
};
|
|
|
|
export async function seedUserSettings(email: string): Promise<User> {
|
|
const userRepository = getRepository(User);
|
|
const user = await userRepository.findOneOrFail({ where: { email } });
|
|
|
|
user.settings = new UserSettings({
|
|
...credentials,
|
|
...allowlistedSettings,
|
|
notificationTypes: {},
|
|
});
|
|
|
|
return userRepository.save(user);
|
|
}
|
|
|
|
export function assertNoCredentials(body: unknown): void {
|
|
const serialized = JSON.stringify(body);
|
|
|
|
const secrets = [
|
|
credentials.pgpKey,
|
|
...credentials.discordIds,
|
|
credentials.pushbulletAccessToken,
|
|
credentials.pushoverApplicationToken,
|
|
credentials.pushoverUserKey,
|
|
credentials.telegramChatId,
|
|
];
|
|
|
|
for (const secret of secrets) {
|
|
assert.ok(!serialized.includes(secret), `${secret} was serialized`);
|
|
}
|
|
}
|