Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Potential security issue with 409 error #166

Closed
Evanion opened this issue Feb 25, 2017 · 1 comment
Closed

Potential security issue with 409 error #166

Evanion opened this issue Feb 25, 2017 · 1 comment

Comments

@Evanion
Copy link

Evanion commented Feb 25, 2017

Related to #55

Steps to reproduce

Create a service with a unique index
Create an object
Create a second object with the same index

Expected behavior

Return a error message that states the object is a duplicate, except for any db specific information.
Something in the line of Duplicate - Index already exists

Actual behavior

You get a 409 Conflict warning containing; full database name, collection name, Index name in DB.

E11000 duplicate key error collection: <dbName>.<collectionName> index: <indexName> dup key: { : <keyValue> }

I consider this a potential security 'leak' that allows an attacker to gain information about internals of the system. having the keyValue in the response is fine, but it would be better to have the response message be an object like this (or similar):

{
  text: "Duplicate - index(es) already exist"
  keys: ["email", "username"]
}

It would allow the frontend to easily see what data was invalid, and present that information to the user .. for instance by setting the specific fields to invalid/hasError

System configuration

Node.js 7.4.0
feathers-cli 1.2.7
feathers-mongoose: 3.6.2

@ekryski
Copy link
Member

ekryski commented Feb 27, 2017

Closed via #168. Released in v5.0.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants