[BUG]: 越权漏洞 || [BUG]: Overreach vulnerability #143
Description
可能存在越权漏洞,如果我知道别人的 converId 和 msgId, 调用这个 api,可以拿个别人的聊天记录片段,进而获取到整个对话,可能修复下列代码 todo 标记的地方?
async fetchNearbyMessage(
ctx: TcContext<{
converseId: string;
messageId: string;
num?: number;
}>
) {
const { converseId, messageId, num = 5 } = ctx.params;
const { t } = ctx.meta;
const message = await this.adapter.model
.findOne({
_id: new Types.ObjectId(messageId),
converseId: new Types.ObjectId(converseId),
})
.limit(1)
.exec();
if (!message) {
throw new DataNotFoundError(t('没有找到消息'));
}
// todo: 此处应该检验 loginUserId 是否在这个 converse 中
const [prev, next] = await Promise.all([
this.adapter.model
.find({
_id: {
$lt: new Types.ObjectId(messageId),
},
converseId: new Types.ObjectId(converseId),
})
.sort({ _id: -1 })
.limit(num)
.exec()
.then((arr) => arr.reverse()),
this.adapter.model
.find({
_id: {
$gt: new Types.ObjectId(messageId),
},
converseId: new Types.ObjectId(converseId),
})
.sort({ _id: 1 })
.limit(num)
.exec(),
]);
console.log({ prev, next });
return this.transformDocuments(ctx, {}, [...prev, message, ...next]);
}
<!--This is a translation content dividing line, the content below is generated by machine, please do not modify the content below-->
---
There may be an overreach vulnerability. If I know someone else’s converId and msgId, I can call this api to get a fragment of someone’s chat history, and then get the entire conversation. Maybe fix the todo mark in the following code?
```typescript
async fetchNearbyMessage(
ctx: TcContext<{
converseId: string;
messageId: string;
num?: number;
}>
) {
const { converseId, messageId, num = 5 } = ctx.params;
const { t } = ctx. meta;
const message = await this.adapter.model
.findOne({
_id: new Types. ObjectId(messageId),
converseId: new Types. ObjectId(converseId),
})
.limit(1)
.exec();
if (!message) {
throw new DataNotFoundError(t('No message found'));
}
// todo: here should check whether loginUserId is in this converse
const [prev, next] = await Promise. all([
this.adapter.model
.find({
_id: {
$lt: new Types. ObjectId(messageId),
},
converseId: new Types. ObjectId(converseId),
})
.sort({ _id: -1 })
.limit(num)
.exec()
.then((arr) => arr.reverse()),
this.adapter.model
.find({
_id: {
$gt: new Types. ObjectId(messageId),
},
converseId: new Types. ObjectId(converseId),
})
.sort({ _id: 1 })
.limit(num)
.exec(),
]);
console. log({ prev, next });
return this. transformDocuments(ctx, {}, [...prev, message, ...next]);
}