Skip to content

Get Rides Scoping Security Issue #680

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eicyer wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Get Rides Scoping Security Issue #680

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8c9b460
Scope GET /api/rides results by caller role
eicyer Mar 8, 2026
5ffde19
Scope GET /api/rides results by caller role and add scoping tests
eicyer Mar 8, 2026
5cceb86
fix types
eicyer Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 28 additions & 6 deletions server/src/router/ride.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ import { validateUser, daysUntilWeekday } from '../util';
import { DriverType } from '../models/driver';
import { RiderType } from '../models/rider';
import { notify } from '../util/notification';
import { Change } from '../util/types';
import { Change, JWTPayload } from '../util/types';
import { UserType } from '../models/subscription';

@anika-4444 anika-4444 Mar 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because of Ben's PR to change all types to the shared types folder, I think you might have to change the imports slightly here. change, payload and usertype stuff should be coming from '../../../shared/build/types'


const router = express.Router();
Expand Down Expand Up @@ -202,6 +202,28 @@ router.get('/', validateUser('User'), (req, res) => {
allDates,
} = req.query;

// Extract caller identity from validated JWT (set by validateUser middleware)
const { id: callerId, userType } = res.locals.user as JWTPayload;

// Scope query params to the caller's own identity.
// Admins: pass through whatever the query provides (existing behaviour).
// Riders: always scope to their own rider ID; discard any ?rider= or ?driver= param.
// Drivers: always scope to their own driver ID; discard any ?rider= or ?driver= param.
let effectiveRider = rider as string | undefined;
let effectiveDriver = driver as string | undefined;

if (userType === UserType.RIDER) {
Comment thread
eicyer marked this conversation as resolved.
Outdated
effectiveRider = callerId;
effectiveDriver = undefined;
} else if (userType === UserType.DRIVER) {
effectiveDriver = callerId;
effectiveRider = undefined;
} else if (userType !== UserType.ADMIN) {
// Unrecognised non-admin role — deny as a defence-in-depth fallback
res.status(403).send({ err: 'Insufficient permissions for this request.' });
return;
}

let condition = new Condition();

if (type) {
Expand All @@ -224,8 +246,8 @@ router.get('/', validateUser('User'), (req, res) => {

// Skip rider condition in Dynamoose query - will filter in JavaScript

if (driver) {
condition = condition.where('driver').eq(driver);
if (effectiveDriver) {
condition = condition.where('driver').eq(effectiveDriver);
}

// Only apply date filter if date is provided and allDates is not true
Expand All @@ -237,17 +259,17 @@ router.get('/', validateUser('User'), (req, res) => {
condition = condition.where('startTime').between(dateStart, dateEnd);
}

if (rider) {
if (effectiveRider) {
// If rider filter is specified, use callback to filter after scan
db.scan(res, Ride, condition, (data: RideType[]) => {
// Filter for rides that include this rider
const riderRides = data.filter((ride) => {
// Check both old (rider) and new (riders) format for compatibility
if (ride.riders && Array.isArray(ride.riders)) {
return ride.riders.some((riderObj) => riderObj.id === rider);
return ride.riders.some((riderObj) => riderObj.id === effectiveRider);
}
// Legacy support for old rider field (if it exists)
if ((ride as any).rider && (ride as any).rider.id === rider) {
if ((ride as any).rider && (ride as any).rider.id === effectiveRider) {
return true;
}
return false;
Expand Down