⭐ Add Firebase provider for security scanning#7128
Open
philipbalinov wants to merge 6 commits intomainfrom
Open
⭐ Add Firebase provider for security scanning#7128philipbalinov wants to merge 6 commits intomainfrom
philipbalinov wants to merge 6 commits intomainfrom
Conversation
New provider that checks Firebase projects for security misconfigurations via public HTTP endpoints. Supports auto-discovery of Firebase config from domains (init.js, inline HTML, JS bundles) or explicit --project-id/--api-key. Resources: - firebase.project: root resource with project metadata - firebase.project.realtimeDatabase: checks public read access - firebase.project.authConfig: authorized domains, sign-in providers, anonymous auth - firebase.project.hosting: .well-known paths (Apple/Android app links) - firebase.project.storage: public bucket listing Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
Contributor
![mondoo-code-review[bot]](https://avatars.githubusercontent.com/in/2834902?s=60&v=4){kind=small}
Member
|
A few other places to add this provider:
|
tas50
changed the title
tas50
changed the title
- Fix RTDB check: drain response body before close for connection reuse, continue to next URL variant on 404 instead of breaking - Fix shallow query response body leak: use defer immediately - Fix hosting well-known checks: read and close inline instead of defer to release connections promptly - Remove dead code in auth config parsing (unused signIn block) - Tighten projectId regex to match GCP project ID format (6-30 chars, lowercase, starts with letter) - Cap JS bundle scanning to 15 URLs to bound network I/O - Add redirect limit (5 hops) on HTTP client for safety when scanning arbitrary domains Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
Switch all child resources (realtimeDatabase, authConfig, hosting, storage) from CreateResource in computed methods to the standard init function pattern. This fixes "cannot convert primitive with NO type information" errors caused by data not surviving gRPC serialization between provider subprocess and executor. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
New attack vector checks for the Firebase provider: - authConfig.emailEnumerationProtection: detects if email enumeration protection is enabled (parses emailPrivacyConfig from Identity Toolkit response, falls back to probing signInWithPassword error messages) - hosting.sourceMapExposed + exposedSourceMaps: scans JS bundles linked from the domain for publicly accessible .js.map files that leak source - firebase.project.firestore: checks if the default Firestore database is publicly readable and extracts exposed collection IDs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
Firestore rules often block document reads but forget to restrict listCollectionIds. The new probe POST to :listCollectionIds reveals top-level collection names even when GET /documents returns 403. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
- Add drainAndClose helper and use it everywhere to ensure HTTP connection reuse (response bodies must be fully read before close) - Replace signInWithPassword probe with createAuthUri for email enumeration detection (read-only, no auth audit log writes) - Add structureExposed field to Firestore resource to distinguish collection ID leaks from actual document read access - Fix checked counter to only increment on actual HTTP requests (skipped CDN scripts no longer count toward the limit) - Document apiKey field semi-public nature in .lr schema Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
| // Merge with any collections found from document reads | ||
| seen := map[string]bool{} | ||
| for _, c := range exposedCollections { | ||
| seen[c.(string)] = true |
There was a problem hiding this comment.
🟡 warning — (Persists from previous review) c.(string) is an unsafe type assertion on []interface{} elements. While current code only appends strings, this is fragile — a future change could introduce a non-string element and cause a panic. Use a safe assertion:
for _, c := range exposedCollections {
if s, ok := c.(string); ok {
seen[s] = true
}
}
Contributor
@check-spelling-bot Report🔴 Please reviewSee the 📂 files view, the 📜action log, or 📝 job summary for details.Unrecognized words (1)assetlinks These words are not needed and should be removedBYOSTo accept these unrecognized words as correct and remove the previously acknowledged and now absent words, you could run the following commands... in a clone of the git@github.com:mondoohq/mql.git repository curl -s -S -L 'https://raw.githubusercontent.com/check-spelling/check-spelling/cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c/apply.pl' |
perl - 'https://github.com/mondoohq/mql/actions/runs/24532582877/attempts/1' &&
git commit -m 'Update check-spelling metadata'Available 📚 dictionaries could cover words (expected and unrecognized) not in the 📘 dictionaryThis includes both expected items (329) from .github/actions/spelling/expect.txt and unrecognized words (1)
Consider adding them (in cspell:node/dict/node.txt
cspell:fullstack/dict/fullstack.txt
cspell:python/src/python/python-lib.txt
cspell:php/dict/php.txt
cspell:python/src/python/python.txtTo stop checking additional dictionaries, add (in check_extra_dictionaries: ""Warnings
|
| Count | |
|---|---|
| 5 |
See
If the flagged items are false positives
If items relate to a ...
-
binary file (or some other file you wouldn't want to check at all).
Please add a file path to the
excludes.txtfile matching the containing file.File paths are Perl 5 Regular Expressions - you can test yours before committing to verify it will match your files.
^refers to the file's path from the root of the repository, so^README\.md$would exclude README.md (on whichever branch you're using). -
well-formed pattern.
If you can write a pattern that would match it,
try adding it to thepatterns.txtfile.Patterns are Perl 5 Regular Expressions - you can test yours before committing to verify it will match your lines.
Note that patterns can't match multiline strings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
firebaseprovider that checks Firebase projects for security misconfigurations via public HTTP endpoints/__/firebase/init.js, inline HTML, and linked JS bundles--project-idand--api-keyflags for direct accessResources
firebase.projectfirebase.project.realtimeDatabase{project}.firebaseio.com/.jsonfirebase.project.authConfigfirebase.project.hosting.well-known/apple-app-site-associationandassetlinks.jsonfirebase.project.storageUsage
Test plan
make providers/build/firebase && make providers/install/firebaseauthConfig.authorizedDomainsreturns the expected domain list🤖 Generated with Claude Code