Files
seerr/server/test/userSettings.ts
fallenbagel 53e77bf347 Merge commit from fork
User.settings is an eager relation, so it rode along into every response embedding a User, exposing
pushover, pushbullet, telegram, discord and PGP values through the request, issue, issue comment,
blocklist, and watchlist endpoints. It now omits it by using User.toJSON(). GET /auth/me builds
settings from seven non-credential fields the web app reads, so locale and region defaults keep
working. Reported as a security advisory, GHSA-8j73-j6rc-q8xh.
2026-09-28 07:06:04 +08:00

53 lines
1.4 KiB
TypeScript

import { getRepository } from '@server/datasource';
import { User } from '@server/entity/User';
import { UserSettings } from '@server/entity/UserSettings';
import assert from 'node:assert/strict';
const credentials = {
pgpKey: 'test-pgp-key',
discordIds: ['112233445566'],
pushbulletAccessToken: 'test-pushbullet-token',
pushoverApplicationToken: 'test-pushover-app-token',
pushoverUserKey: 'test-pushover-user-key',
telegramChatId: '-1001234567',
};
export const allowlistedSettings = {
locale: 'de',
discoverRegion: 'DE',
streamingRegion: 'DE',
originalLanguage: 'de',
watchlistSyncMovies: true,
watchlistSyncTv: false,
};
export async function seedUserSettings(email: string): Promise<User> {
const userRepository = getRepository(User);
const user = await userRepository.findOneOrFail({ where: { email } });
user.settings = new UserSettings({
...credentials,
...allowlistedSettings,
notificationTypes: {},
});
return userRepository.save(user);
}
export function assertNoCredentials(body: unknown): void {
const serialized = JSON.stringify(body);
const secrets = [
credentials.pgpKey,
...credentials.discordIds,
credentials.pushbulletAccessToken,
credentials.pushoverApplicationToken,
credentials.pushoverUserKey,
credentials.telegramChatId,
];
for (const secret of secrets) {
assert.ok(!serialized.includes(secret), `${secret} was serialized`);
}
}