Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't allow listing indexes via the retrieveDocument API #32

Open
4 tasks
tripott opened this issue Mar 18, 2022 · 0 comments
Open
4 tasks

Don't allow listing indexes via the retrieveDocument API #32

tripott opened this issue Mar 18, 2022 · 0 comments
Labels
bug Something isn't working

Comments

@tripott
Copy link

tripott commented Mar 18, 2022

We would need to:

  • Prevent new documents from having the _id _index, either by rejecting those documents, or mapping the string _index to another internally managed string. Affected apis: createDocument bulkDocuments
  • when a retrieveDocument request arrives, either reject the lookup for _index or map the string similar to aforementioned mapping
  • IF the mapping approach is taken, the document's _id would need to be reverse mapped back to the string _index on any retrievals. Affected apis: retrieveDocument, listDocuments, queryDocuments
  • add a test case for each

The easier of the two is just to reject any documents with an _id set to _index, but is arguably leaking impl details to the consumer.

Background

Related Issue: hyper63/hyper#486

So something I discovered today that probably should not be allowed?

If I have a hyper data service, I can retrieve all of the indexes that exist on the database by calling GET /data/default/_index. This gets handled by the "get document by id" route, which calls retrieveDocument on the adapter.

Ultimately the CouchDB adapter does:

asyncFetch(`${config.origin}/${db}/${id}`,...)

with _indexas the id.

Of course, there isn't a document with _id _index, BUT that does map to the route on the CouchDB API that lists all of the indexes for the DB: https://docs.couchdb.org/en/stable/api/database/find.html#get--db-_index. And since the data port says anything can be returned from the retrieveDocument API, hyper simply returns that response and you get something like:

{
	"total_rows": 1,
	"indexes": [
		{
			"ddoc": null,
			"name": "_all_docs",
			"type": "special",
			"def": {
				"fields": [
					{
						"_id": "asc"
					}
				]
			}
		}
	]
}
@TillaTheHun0 TillaTheHun0 added the bug Something isn't working label Mar 31, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants