|
| 1 | +import { mkdtempSync, rmSync } from 'node:fs'; |
| 2 | +import { createRequire } from 'node:module'; |
| 3 | +import os from 'node:os'; |
| 4 | +import path from 'node:path'; |
| 5 | +import { fileURLToPath, pathToFileURL } from 'node:url'; |
| 6 | + |
| 7 | +const currentDir = path.dirname(fileURLToPath(import.meta.url)); |
| 8 | +const applicationDir = path.resolve(currentDir, '../application'); |
| 9 | + |
| 10 | +// resolves to the BUILT package (adminforth/dist) the test application runs on; |
| 11 | +// rebuild it (`npx tsc` in adminforth/) after editing adminforth sources or the assertions below test stale code |
| 12 | +const require = createRequire(import.meta.url); |
| 13 | +// jest's resolver does not know the `node:sqlite` builtin, so it is required directly |
| 14 | +const { DatabaseSync } = require('node:sqlite'); |
| 15 | +const adminforthEntry = require.resolve('adminforth', { paths: [applicationDir] }); |
| 16 | +const { default: AdminForth } = await import(pathToFileURL(adminforthEntry).href); |
| 17 | + |
| 18 | +const fixtureDir = mkdtempSync(path.join(os.tmpdir(), 'af-filter-injection-')); |
| 19 | +const dbPath = path.join(fixtureDir, 'db.sqlite'); |
| 20 | +const db = new DatabaseSync(dbPath); |
| 21 | +db.exec(` |
| 22 | + CREATE TABLE users (id INTEGER PRIMARY KEY, email TEXT NOT NULL); |
| 23 | + INSERT INTO users VALUES (1, 'a@example.test'); |
| 24 | + INSERT INTO users VALUES (2, 'b@example.test'); |
| 25 | + CREATE TABLE posts (id INTEGER PRIMARY KEY, title TEXT NOT NULL); |
| 26 | + INSERT INTO posts VALUES (1, 'hello'); |
| 27 | + -- comments.record_id is a polymorphic foreign key, so it makes both users and posts |
| 28 | + -- polymorphic targets (the same shape the audit-log plugin produces for every resource) |
| 29 | + CREATE TABLE comments (id INTEGER PRIMARY KEY, record_type TEXT NOT NULL, record_id TEXT NOT NULL); |
| 30 | +`); |
| 31 | +db.close(); |
| 32 | + |
| 33 | +process.env.ADMINFORTH_SECRET ??= 'x'.repeat(64); |
| 34 | + |
| 35 | +delete (globalThis as any).adminforth; |
| 36 | +const app = new AdminForth({ |
| 37 | + baseUrl: '', |
| 38 | + auth: { |
| 39 | + usersResourceId: 'users', |
| 40 | + usernameField: 'email', |
| 41 | + passwordHashField: 'email', |
| 42 | + }, |
| 43 | + dataSources: [{ id: 'sqlite', url: `sqlite://${dbPath}` }], |
| 44 | + resources: [ |
| 45 | + { |
| 46 | + resourceId: 'users', |
| 47 | + table: 'users', |
| 48 | + dataSource: 'sqlite', |
| 49 | + columns: [ |
| 50 | + { name: 'id', primaryKey: true }, |
| 51 | + { name: 'email' }, |
| 52 | + ], |
| 53 | + }, |
| 54 | + { |
| 55 | + resourceId: 'posts', |
| 56 | + table: 'posts', |
| 57 | + dataSource: 'sqlite', |
| 58 | + columns: [ |
| 59 | + { name: 'id', primaryKey: true }, |
| 60 | + { name: 'title' }, |
| 61 | + ], |
| 62 | + }, |
| 63 | + { |
| 64 | + resourceId: 'comments', |
| 65 | + table: 'comments', |
| 66 | + dataSource: 'sqlite', |
| 67 | + columns: [ |
| 68 | + { name: 'id', primaryKey: true }, |
| 69 | + { name: 'record_type', showIn: { create: false, edit: false } }, |
| 70 | + { |
| 71 | + name: 'record_id', |
| 72 | + foreignResource: { |
| 73 | + polymorphicOn: 'record_type', |
| 74 | + polymorphicResources: [ |
| 75 | + { resourceId: 'users', whenValue: 'users' }, |
| 76 | + { resourceId: 'posts', whenValue: 'posts' }, |
| 77 | + ], |
| 78 | + }, |
| 79 | + }, |
| 80 | + ], |
| 81 | + }, |
| 82 | + ], |
| 83 | + menu: [{ label: 'Users', resourceId: 'users' }], |
| 84 | +}); |
| 85 | +await app.discoverDatabases(); |
| 86 | + |
| 87 | +afterAll(() => { |
| 88 | + rmSync(fixtureDir, { recursive: true, force: true }); |
| 89 | +}); |
| 90 | + |
| 91 | +// users is a polymorphic target (via comments.record_id), so it goes through the relaxed field check |
| 92 | +const usersResource = () => app.config.resources.find((r: any) => r.resourceId === 'users'); |
| 93 | +const connector = () => (app as any).connectors.sqlite; |
| 94 | + |
| 95 | +describe('filter injection hardening', () => { |
| 96 | + describe('field names are not passed through unchecked on a polymorphic target', () => { |
| 97 | + it.each([ |
| 98 | + ['a $-prefixed operator name', '$where'], |
| 99 | + ['a $-prefixed comment', '$comment'], |
| 100 | + ['a SQL identifier break', 'email" = "email'], |
| 101 | + ['a truly unknown field', 'definitely_not_a_column'], |
| 102 | + ])('rejects %s', (_, field) => { |
| 103 | + expect(() => connector().validateAndNormalizeFilters({ field, operator: 'eq', value: 'x' }, usersResource())).toThrow(); |
| 104 | + }); |
| 105 | + |
| 106 | + it('still allows a column that exists on a sibling polymorphic target', () => { |
| 107 | + // `title` belongs to posts, not users, but both are targets of comments.record_id, |
| 108 | + // so filtering users by it must stay allowed (the reason the relaxed check exists) |
| 109 | + const result = connector().validateAndNormalizeFilters({ field: 'title', operator: 'eq', value: 'x' }, usersResource()); |
| 110 | + expect(result.ok).toBe(true); |
| 111 | + }); |
| 112 | + }); |
| 113 | +}); |
0 commit comments