JKHeadley / JKHeadley/rest-hapi
Authorize/restrict $embed by association scopes
Open
vulnerability
- Dominant language
- JavaScript
- Stars
- 1.2k
- Forks
- 155
- PR merge metrics
- No merged PRs in 30d
Description
A user should not be able to $embed an association if they don't have access to read/GET the association endpoint.
Contributor guide
Research direction
No files or tests are named. Start at the $embed handling and the association endpoint's read authorization, then trace how association scopes are checked; done means an unauthorized user cannot embed the association while an authorized user still can.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- api, authorization, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100