Fix: restrict list-things field projection to block credential leak

workers/lib/server/handlers/global.handlers.js

@@ -1,7 +1,7 @@
 'use strict'
 const gLibUtilBase = require('@bitfinex/lib-js-util-base')
 const { GLOBAL_DATA_TYPES, LOCKED_TIMEZONE_DEFAULT, POOL_REBATE_SOURCES } = require('../../constants')
-const { parseJsonQueryParam } = require('../../utils')
+const { parseJsonQueryParam, sanitizeIncludeFields } = require('../../utils')
 const {
   getAutoPoolRebates,
   getCombinedPoolRebates,
@@ -29,7 +29,7 @@ async function getGlobalData (ctx, req) {
   }
 
   if (req.query.fields) {
-    req.query.fields = parseJsonQueryParam(req.query.fields, 'ERR_FIELDS_INVALID_JSON')
+    req.query.fields = sanitizeIncludeFields(parseJsonQueryParam(req.query.fields, 'ERR_FIELDS_INVALID_JSON'))
   }
 
   if (type === GLOBAL_DATA_TYPES.POOL_REBATES) {
@@ -146,7 +146,7 @@ async function setFeatures (ctx, req) {
 
 async function getGlobalConfig (ctx, req, rep) {
   if (req.query.fields) {
-    req.query.fields = parseJsonQueryParam(req.query.fields, 'ERR_FIELDS_INVALID_JSON')
+    req.query.fields = sanitizeIncludeFields(parseJsonQueryParam(req.query.fields, 'ERR_FIELDS_INVALID_JSON'))
   }
 
   return await ctx.dataProxy.requestDataMap('getGlobalConfig', req.query)

workers/lib/server/handlers/miners.handlers.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const { parseJsonQueryParam, flattenRpcResults } = require('../../utils')
+const { parseJsonQueryParam, flattenRpcResults, sanitizeIncludeFields } = require('../../utils')
 const {
   MINER_FIELD_MAP,
   MINER_PROJECTION_MAP,
@@ -178,15 +178,6 @@ async function listMiners (ctx, req) {
   }
 }
 
-function sanitizeIncludeFields (fields) {
-  if (!fields || typeof fields !== 'object') return null
-  const clean = {}
-  for (const [key, value] of Object.entries(fields)) {
-    if (value === 1) clean[key] = 1
-  }
-  return Object.keys(clean).length ? clean : null
-}
-
 function summarizeMinerActivity (miners) {
   const summary = { total: miners.length, offline: 0, powerModes: {} }
   for (const miner of miners) {

workers/lib/server/handlers/things.handlers.js

@@ -4,7 +4,7 @@ const {
   AUTH_LEVELS,
   COMMENT_ACTION
 } = require('../../constants')
-const { parseJsonQueryParam, flattenRpcResults } = require('../../utils')
+const { parseJsonQueryParam, flattenRpcResults, sanitizeIncludeFields } = require('../../utils')
 const { assertSafeMongoQuery } = require('../lib/queryUtils')
 
 async function listThingsRoute (ctx, req, rep) {
@@ -18,7 +18,7 @@ async function listThingsRoute (ctx, req, rep) {
   }
 
   if (req.query.fields) {
-    req.query.fields = parseJsonQueryParam(req.query.fields, 'ERR_FIELDS_INVALID_JSON')
+    req.query.fields = sanitizeIncludeFields(parseJsonQueryParam(req.query.fields, 'ERR_FIELDS_INVALID_JSON'))
   }
 
   return await ctx.dataProxy.requestDataMap('listThings', req.query)
@@ -100,7 +100,7 @@ async function processThingComment (ctx, req, operation = COMMENT_ACTION.ADD) {
 
 async function getWorkerConfig (ctx, req, rep) {
   if (req.query.fields) {
-    req.query.fields = parseJsonQueryParam(req.query.fields, 'ERR_FIELDS_INVALID_JSON')
+    req.query.fields = sanitizeIncludeFields(parseJsonQueryParam(req.query.fields, 'ERR_FIELDS_INVALID_JSON'))
   }
 
   return await ctx.dataProxy.requestDataMap('getWrkConf', req.query)

workers/lib/utils.js

@@ -73,6 +73,19 @@ const parseJsonQueryParam = (jsonString, errorCode = 'ERR_INVALID_JSON') => {
   }
 }
 
+// Restricts a parsed `fields` projection to the `{ key: 1 }` inclusion shape the
+// worker's openrpc contract declares. Dropping every other value blocks mingo
+// field-path renames (`"$opts.password"`) that move credentials past the rack's
+// post-projection redaction, and `__proto__`-path writes that pollute the process.
+const sanitizeIncludeFields = (fields) => {
+  if (!fields || typeof fields !== 'object') return null
+  const clean = {}
+  for (const [key, value] of Object.entries(fields)) {
+    if (value === 1) clean[key] = 1
+  }
+  return Object.keys(clean).length ? clean : null
+}
+
 const runParallel = (tasks) =>
   new Promise((resolve, reject) => {
     async.parallel(tasks, (err, results) => {
@@ -238,6 +251,7 @@ module.exports = {
   getRpcTimeout,
   getAuthTokenFromHeaders,
   parseJsonQueryParam,
+  sanitizeIncludeFields,
   getStartOfDay,
   localDayStart,
   localWeekStart,