When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id
概要
When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the @Entity decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the id of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the apiPrefilter option to a filter object instead of a function.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com