v3: privateAttributes in REST not working (on plugin model?)

[laurenskling]

Bug report

I have a model in a plugin using privateAttributes, but nothing seems to happen.

Describe the bug

in my model (in a plugin) I am using:

options: {
    increments: false,
    timestamps: false,
    privateAttributes: ['__v', '_id', 'source', 'provider_metadata'],
  },

But the output remains the same. Whatever I put in this privateAttributes list.

Steps to reproduce the behavior

Create a model with privateAttributes.
In a plugin.
on MongoDB.

Expected behavior

fields in the privateAttributes should not appear in REST calls

System

• Node.js version: 14.19.0
• NPM version: 6.14.15
• Strapi version: 3.6.0
• Database: MongoDB <3
• Operating system: MacOS

[derrickmehaffy]

Strapi version: 3.6.0
Database: MongoDB <3

We aren't currently fixing bugs in v3 unless they are critical in nature or security related. Unless this can be reproduced on v4 I'll need to mark as closed for now.

[laurenskling]

Doesn't this sound like a security leak? If I assume my data is private but it isn't..

Just tested it outside of a plugin, and there privateAttributes works as expected. So it's the running from within a plugin. As many other things that are shaky from models in plugins :(

[strapi-bot]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/my-feelings-about-strapi-dropping-v3-like-a-hot-potato/16508/1

[derrickmehaffy]

Doesn't this sound like a security leak? If I assume my data is private but it isn't..

Just tested it outside of a plugin, and there privateAttributes works as expected. So it's the running from within a plugin. As many other things that are shaky from models in plugins :(

There is a lot of processing that isn't done on plugins as it's somewhat expected the plugin authors to handle it themselves due to the nature of extremely custom logic. We can't assume that a plugin author will do what we expect them too so we simply don't apply a lot to it.