When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id
Résumé
When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the @Entity decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the id of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the apiPrefilter option to a filter object instead of a function.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com