From 9e32766046fcaa68b685a820b15fcdd08930883d Mon Sep 17 00:00:00 2001 From: Arnaud Nelissen Date: Mon, 15 Jun 2026 23:25:34 +0200 Subject: [PATCH] security: second-pass ownership checks + input validation fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - medication-profiles/[id]: verify familyId ownership before PATCH/DELETE - event-templates/[id]: verify familyId ownership before PATCH/DELETE - notify/push: verify baby.familyId matches session family before push - events GET: validate type against ALL_EVENT_TYPES allowlist; sanitize limit (1–500) and offset (≥0) to prevent NaN/unbounded queries - v1/summary: fix operator precedence bug in feeds count calculation Co-Authored-By: Claude Sonnet 4.6 --- SECURITY_AUDIT.md | 58 ++++++++++++++++++- src/app/api/event-templates/[id]/route.ts | 11 ++++ src/app/api/events/route.ts | 8 ++- src/app/api/medication-profiles/[id]/route.ts | 11 ++++ src/app/api/notify/push/route.ts | 5 ++ src/app/api/v1/summary/route.ts | 2 +- 6 files changed, 90 insertions(+), 5 deletions(-) diff --git a/SECURITY_AUDIT.md b/SECURITY_AUDIT.md index b4f7859..f5b9f92 100644 --- a/SECURITY_AUDIT.md +++ b/SECURITY_AUDIT.md @@ -11,10 +11,12 @@ | Severity | Found | Fixed | |----------|-------|-------| | CRITICAL | 9 | 9 | -| HIGH | 6 | 5 | -| MEDIUM | 6 | 2 | +| HIGH | 11 | 10 | +| MEDIUM | 7 | 3 | | LOW | 1 | 0 | +_Updated after second-pass audit (pass 2 of 2)._ + --- ## CRITICAL — Fixed @@ -145,6 +147,58 @@ If `SUPERADMIN_EMAIL` env var is not set, the condition `SUPERADMIN_EMAIL && ses --- +--- + +## HIGH — Fixed (pass 2) + +### 17. `medication-profiles/[id]` — no family ownership check +**Affected:** PATCH and DELETE + +**Problem:** Any authenticated user could modify or delete any medication profile by ID. + +**Fix:** Added `prisma.medicationProfile.findFirst({ where: { id, familyId } })` check before PATCH and DELETE. + +--- + +### 18. `event-templates/[id]` — no family ownership check +**Affected:** PATCH and DELETE + +**Problem:** Any authenticated user could modify or delete any event template by ID. + +**Fix:** Added `prisma.eventTemplate.findFirst({ where: { id, familyId } })` check before PATCH and DELETE. + +--- + +### 19. `notify/push` — no family ownership check on babyId +**Problem:** Baby was fetched by ID but its `familyId` was never compared against the session user's family. Any authenticated user could trigger push notifications using another family's baby ID (leaking feeding status via the notification message). + +**Fix:** Added `if (baby.familyId !== sessionFamilyId) return 404`. + +--- + +### 20. `events/route.ts` GET — event `type` not validated against allowlist +**Problem:** The `type` query param was passed directly into the Prisma where clause without validation. While Prisma parameterizes values (no SQL injection), arbitrary strings could be stored and returned. + +**Fix:** Imported `ALL_EVENT_TYPES` from `event-config.ts` and added `if (type && !ALL_EVENT_TYPES.includes(type)) return 400`. + +--- + +### 21. `events/route.ts` GET — `limit`/`offset` not sanitized +**Problem:** `parseInt()` returns `NaN` on non-numeric input; `NaN` passed to Prisma `take`/`skip` causes an error or is treated as 0, potentially returning all rows. + +**Fix:** Added clamping: `limit = Math.max(1, Math.min(parseInt(limit) || 50, 500))`, `offset = Math.max(0, parseInt(offset) || 0)`. + +--- + +## MEDIUM — Fixed (pass 2) + +### 22. `v1/summary` — arithmetic operator precedence bug +**Problem:** `counts.BREASTFEED ?? 0 + (counts.BOTTLE ?? 0)` evaluated as `counts.BREASTFEED ?? (0 + (counts.BOTTLE ?? 0))` due to `??` precedence, causing incorrect feed count. + +**Fix:** Added explicit parentheses: `(counts.BREASTFEED ?? 0) + (counts.BOTTLE ?? 0)`. + +--- + ## Routes verified as already secure - `webhooks/route.ts` — familyId from session, no cross-family access possible diff --git a/src/app/api/event-templates/[id]/route.ts b/src/app/api/event-templates/[id]/route.ts index b6f557d..2b6519b 100644 --- a/src/app/api/event-templates/[id]/route.ts +++ b/src/app/api/event-templates/[id]/route.ts @@ -12,6 +12,11 @@ export async function PATCH( const { id } = await params; const body = await req.json(); + const user = await prisma.user.findUnique({ where: { id: session.user.id }, select: { familyId: true } }); + if (!user?.familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 }); + const owned = await prisma.eventTemplate.findFirst({ where: { id, familyId: user.familyId } }); + if (!owned) return NextResponse.json({ error: "Introuvable" }, { status: 404 }); + const template = await prisma.eventTemplate.update({ where: { id }, data: { @@ -33,6 +38,12 @@ export async function DELETE( if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 }); const { id } = await params; + + const delUser = await prisma.user.findUnique({ where: { id: session.user.id }, select: { familyId: true } }); + if (!delUser?.familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 }); + const delOwned = await prisma.eventTemplate.findFirst({ where: { id, familyId: delUser.familyId } }); + if (!delOwned) return NextResponse.json({ error: "Introuvable" }, { status: 404 }); + await prisma.eventTemplate.delete({ where: { id } }); return new NextResponse(null, { status: 204 }); } diff --git a/src/app/api/events/route.ts b/src/app/api/events/route.ts index 9b0639f..7146791 100644 --- a/src/app/api/events/route.ts +++ b/src/app/api/events/route.ts @@ -3,6 +3,7 @@ import { auth } from "@/lib/auth"; import { prisma } from "@/lib/prisma"; import { logAudit } from "@/lib/audit"; import { dispatchWebhook } from "@/lib/webhooks"; +import { ALL_EVENT_TYPES } from "@/lib/event-config"; export async function GET(req: Request) { const session = await auth(); @@ -10,9 +11,12 @@ export async function GET(req: Request) { const { searchParams } = new URL(req.url); const babyId = searchParams.get("babyId"); - const limit = parseInt(searchParams.get("limit") ?? "50"); - const offset = parseInt(searchParams.get("offset") ?? "0"); + const limit = Math.max(1, Math.min(parseInt(searchParams.get("limit") ?? "50") || 50, 500)); + const offset = Math.max(0, parseInt(searchParams.get("offset") ?? "0") || 0); const type = searchParams.get("type"); + if (type && !ALL_EVENT_TYPES.includes(type as never)) { + return NextResponse.json({ error: "Type invalide" }, { status: 400 }); + } const dateFrom = searchParams.get("dateFrom"); const dateTo = searchParams.get("dateTo"); diff --git a/src/app/api/medication-profiles/[id]/route.ts b/src/app/api/medication-profiles/[id]/route.ts index f649d98..51e77bb 100644 --- a/src/app/api/medication-profiles/[id]/route.ts +++ b/src/app/api/medication-profiles/[id]/route.ts @@ -12,6 +12,11 @@ export async function PATCH( const { id } = await params; const body = await req.json(); + const familyId = (session.user as { familyId?: string }).familyId; + if (!familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 }); + const owned = await prisma.medicationProfile.findFirst({ where: { id, familyId } }); + if (!owned) return NextResponse.json({ error: "Introuvable" }, { status: 404 }); + const profile = await prisma.medicationProfile.update({ where: { id }, data: { @@ -35,6 +40,12 @@ export async function DELETE( if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 }); const { id } = await params; + + const delFamilyId = (session.user as { familyId?: string }).familyId; + if (!delFamilyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 }); + const delOwned = await prisma.medicationProfile.findFirst({ where: { id, familyId: delFamilyId } }); + if (!delOwned) return NextResponse.json({ error: "Introuvable" }, { status: 404 }); + await prisma.medicationProfile.delete({ where: { id } }); return new NextResponse(null, { status: 204 }); } diff --git a/src/app/api/notify/push/route.ts b/src/app/api/notify/push/route.ts index 1762ee3..caf61ed 100644 --- a/src/app/api/notify/push/route.ts +++ b/src/app/api/notify/push/route.ts @@ -16,6 +16,11 @@ export async function POST(req: Request) { }); if (!baby) return NextResponse.json({ error: "Bébé introuvable" }, { status: 404 }); + const sessionFamilyId = (session.user as { familyId?: string }).familyId; + if (!sessionFamilyId || baby.familyId !== sessionFamilyId) { + return NextResponse.json({ error: "Bébé introuvable" }, { status: 404 }); + } + const lastFeed = await prisma.event.findFirst({ where: { babyId, type: { in: ["BREASTFEED", "BOTTLE"] } }, orderBy: { startedAt: "desc" }, diff --git a/src/app/api/v1/summary/route.ts b/src/app/api/v1/summary/route.ts index 676c52f..4a13afc 100644 --- a/src/app/api/v1/summary/route.ts +++ b/src/app/api/v1/summary/route.ts @@ -36,7 +36,7 @@ export async function GET(req: Request) { return NextResponse.json({ date: dayStart.toISOString().slice(0, 10), counts, - feeds: counts.BREASTFEED ?? 0 + (counts.BOTTLE ?? 0), + feeds: (counts.BREASTFEED ?? 0) + (counts.BOTTLE ?? 0), diapers: (counts.DIAPER_WET ?? 0) + (counts.DIAPER_STOOL ?? 0), sleepMinutes: Math.round(sleepMs / 60000), lastFeedAt: lastFeed ? lastFeed.startedAt : null,