fix(users): security review, filter user data return by default 🐛

config/defaults/development.js

@@ -83,7 +83,7 @@ module.exports = {
   },
   whitelists: {
     users: {
-      default: ['_id', 'id', 'firstName', 'lastName', 'displayName', 'email', 'roles', 'avatar', 'resetPasswordToken', 'resetPasswordExpires'],
+      default: ['_id', 'id', 'firstName', 'lastName', 'displayName', 'email', 'roles', 'avatar', 'provider', 'updatedAt', 'createdAt', 'resetPasswordToken', 'resetPasswordExpires'],
       update: ['firstName', 'lastName', 'email', 'avatar'],
       updateAdmin: ['firstName', 'lastName', 'email', 'avatar', 'roles'],
       recover: ['password', 'resetPasswordToken', 'resetPasswordExpires'],
@@ -108,7 +108,7 @@ module.exports = {
   },
   // jwt is for token authentification
   jwt: {
-    secret: 'test', // secret for hash
+    secret: 'WaosSecretKeyExampleToChnageAbsolutely', // secret for hash
     expiresIn: 7 * 24 * 60 * 60, // token expire in x sec
   },
   mailer: {

modules/users/config/strategies/jwt.js

@@ -15,7 +15,7 @@ const cookieExtractor = (req) => {
 
 async function verifyCallback(jwtPayload, done) {
   try {
-    const user = await UserService.get({ id: jwtPayload.userId });
+    const user = await UserService.getBrut({ id: jwtPayload.userId });
     if (user) return done(null, user);
 
     return done(null, false);

modules/users/controllers/admin.controller.js

@@ -70,7 +70,7 @@ exports.delete = async (req, res) => {
  */
 exports.userByID = async (req, res, next, id) => {
   try {
-    const user = await UserService.get({ id });
+    const user = await UserService.getBrut({ id });
     if (!user) responses.error(res, 404, 'Not Found', 'No User with that identifier has been found')();
     else {
       req.model = user;

modules/users/controllers/users/users.password.controller.js

@@ -24,7 +24,7 @@ exports.forgot = async (req, res) => {
 
   // get user generate and add token
   try {
-    user = await UserService.get({ email: req.body.email });
+    user = await UserService.getBrut({ email: req.body.email });
     if (!user) return responses.error(res, 400, 'Bad Request', 'No account with that email has been found')();
     if (user.provider !== 'local') return responses.error(res, 400, 'Bad Request', `It seems like you signed up using your ${user.provider} account`)();
 
@@ -136,7 +136,7 @@ exports.updatePassword = async (req, res) => {
 
   // get user, check password, update user, login again
   try {
-    user = await UserService.get({ id: req.user.id });
+    user = await UserService.getBrut({ id: req.user.id });
     if (!user) return responses.error(res, 400, 'Bad Request', 'User is not found')();
 
     if (!await UserService.comparePassword(req.body.currentPassword, user.password)) return responses.error(res, 422, 'Unprocessable Entity', 'Current password is incorrect')();

modules/users/services/user.service.js

@@ -18,9 +18,10 @@ const saltRounds = 10;
  * @param {Object} user
  * @return {Object} user
  */
-const removeSensitive = (user) => {
+const removeSensitive = (user, conf) => {
   if (!user || typeof user !== 'object') return null;
-  return _.assignIn(user, _.pick(user, config.whitelists.users.default));
+  const keys = conf || config.whitelists.users.default;
+  return _.pick(user, keys);
 };
 
 /**
@@ -29,7 +30,7 @@ const removeSensitive = (user) => {
  */
 exports.list = async () => {
   const result = await UserRepository.list();
-  return Promise.resolve(result);
+  return Promise.resolve(result.map((user) => removeSensitive(user)));
 };
 
 /**
@@ -65,14 +66,24 @@ exports.get = async (user) => {
   return Promise.resolve(removeSensitive(result));
 };
 
+/**
+ * @desc Function to ask repository to get a user by id or email without filter data return (test & intern usage)
+ * @param {Object} user.id / user.email
+ * @return {Object} user
+ */
+exports.getBrut = async (user) => {
+  const result = await UserRepository.get(user);
+  return Promise.resolve(result);
+};
+
 /**
  * @desc Function to ask repository to search users by request
  * @param {Object} mongoose input request
  * @return {Array} users
  */
 exports.search = async (input) => {
   const result = await UserRepository.search(input);
-  return Promise.resolve(removeSensitive(result));
+  return Promise.resolve(result.map((user) => removeSensitive(user)));
 };
 
 /**
@@ -83,9 +94,9 @@ exports.search = async (input) => {
  * @return {Promise} user -
  */
 exports.update = async (user, body, option) => {
-  if (!option) user = _.assignIn(user, _.pick(body, config.whitelists.users.update));
-  else if (option === 'admin') user = _.assignIn(user, _.pick(body, config.whitelists.users.updateAdmin));
-  else if (option === 'recover') user = _.assignIn(user, _.pick(body, config.whitelists.users.recover));
+  if (!option) user = _.assignIn(user, removeSensitive(body, config.whitelists.users.update));
+  else if (option === 'admin') user = _.assignIn(user, removeSensitive(body, config.whitelists.users.updateAdmin));
+  else if (option === 'recover') user = _.assignIn(user, removeSensitive(body, config.whitelists.users.recover));
 
   user.updated = Date.now();