Objection.js: Potential security concern

[linkenneth]

@koskimas I sent you an email.

[heisian]

What is the concern?

[linkenneth]

I'm working with @koskimas privately to triage and verify this. If this is a security issue, it'd be best not to publicly disclose until fixed.

I'm also not entirely sure who I should be contacting about this. @heisian If you'd like to help out, can you ping @koskimas and have him add you to our thread?

[heisian]

Hi @koskimas I am interested in what the security concern is, please add to thread.. thanks

[koskimas]

Could you both join objection's gitter and we could continue the discussion in a private group chat?

[linkenneth]

Joined.

[elhigu]

let me know if there is anything needed from me

[kibertoad]

@linkenneth Is this issue still relevant and should be kept open?

[linkenneth]

@kibertoad Yes, this is still relevant. It's been addressed but not yet resolved.

[heisian]

I think this issue is a low-risk attack vector that can be safely published here with a repro script - I think the community in this case is better served by being aware of the risks rather than being kept in the dark. If @koskimas agrees, please post what you've found @linkenneth - thanks.

[linkenneth]

@heisian Sure, this is up to @koskimas.

[koskimas]

@heisian @linkenneth @kibertoad I don't think we should publish the attack vector. If we do that, everyone will need to add hacks to their apps (because there is no clean way to prevent it in objection yet) to prevent that, while I'm pretty confident that no one will exploit the vector if we don't publish it. It's pretty easy to figure out, but to guess the needed stuff to exploit it is basically impossible. Do you agree?

[kibertoad]

@koskimas Yeah, it's not a good idea to disclose the vector before the fix. I presume fix is not straightforward and requires a bit of internal changes?..

[koskimas]

The fix is really easy, but it requires a breaking change and because of semver, a 2.0 release. I don't want to release 2.0 just because of this low risk security issue.

[linkenneth]

@koskimas Yes, I agree. In that case let's leave this open.

[nspessot]

Hi, was this issue fixed? which version?

[koskimas]

@nspessot

Look couple of comments up

The fix is really easy, but it requires a breaking change and because of semver, a 2.0 release. I don't want to release 2.0 just because of this low risk security issue.

[kibertoad]

@koskimas We are dropping support for Node.js 6 in 0.18.0. Might be a good time to bump Objection.js major when upgrading to the next knex version.

[koskimas]

Handled in v2.0 branch.