Fix attribute leak
MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -1456,18 +1456,22 @@ export default class AuthorizationService {
}
private static filterProjectFields(authFields: string[], httpProjectField: string): string[] {
- let fields = authFields;
- // Only allow projected fields
- const httpProjectFields = AuthorizationService.httpFilterProjectToArray(httpProjectField);
- if (!Utils.isEmptyArray(httpProjectFields)) {
- fields = authFields.filter(
- (authField) => httpProjectFields.includes(authField));
- }
+ // Init with authorization fields
+ let applicableProjectedFields = authFields;
// Remove '*'
- if (!Utils.isEmptyArray(fields)) {
- fields = fields.filter((field) => field !== '*');
+ if (!Utils.isEmptyArray(applicableProjectedFields)) {
+ applicableProjectedFields = applicableProjectedFields.filter((field) => field !== '*');
+ }
+ // Build and clean http projected field to only contain authorized fields
+ let httpProjectFields = AuthorizationService.httpFilterProjectToArray(httpProjectField);
+ if(!Utils.isEmptyArray(applicableProjectedFields) && !Utils.isEmptyArray(httpProjectFields)) {
+ httpProjectFields = httpProjectFields.filter(
+ (httpProjectField) => applicableProjectedFields.includes(httpProjectField));
+ }
+ if (!Utils.isEmptyArray(httpProjectFields)) {
+ return httpProjectFields;
}
- return fields;
+ return applicableProjectedFields;
}
private static async processDynamicFilters(tenant: Tenant, userToken: UserToken, authAction: Action, authEntity: Entity,

Fix attribute leak