Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GraphQL schema "domain" leaks other domains when query does not contains "name" #463

Closed
petruki opened this issue Nov 8, 2023 · 0 comments
Assignees
Labels
bug Something isn't working security Vulnerability detected
Milestone

Comments

@petruki
Copy link
Member

petruki commented Nov 8, 2023

Describe the bug
The GraphQL query domain used by SDK to retrieve the snapshot can leak other domains when the parameter name is not defined.
This security issue needs SDKs to be re-built or re-compiled, however, the API can be accessed externally and therefore the params can be redefined.

To Reproduce from Switcher Management
Steps to reproduce the behavior:

  1. Hit the API using domain query only using the environment and _component names.

Expected behavior
When using the Client SDK, the Domain name is already embedded into the token, therefore, the name can be discarded in the upcoming releases.
When using Admin users, the name or Domain ID should be required.

@petruki petruki added bug Something isn't working security Vulnerability detected labels Nov 8, 2023
@petruki petruki added this to the v1.2.8 milestone Nov 8, 2023
@petruki petruki self-assigned this Nov 8, 2023
@petruki petruki closed this as completed in 1258918 Nov 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working security Vulnerability detected
Projects
None yet
Development

No branches or pull requests

1 participant