Security: Prevent session enumeration via RLS policies - #1879
Security: Prevent session enumeration via RLS policies#1879anshul23102 wants to merge 3 commits into
Conversation
Implement input sanitization for all message types to prevent stored XSS attacks: - Add sanitize.ts utility module using DOMPurify for consistent sanitization - Sanitize user messages before storing in useMessages.ts - Sanitize room chat messages in useRoomChat.ts - Sanitize chatbot messages in useChatbot.ts This ensures malicious content cannot be stored in the database or rendered to other users, protecting against stored XSS vulnerabilities. Fixes durdana3105#1874 Signed-off-by: Anshul Jain <anshul23102@iiitd.ac.in>
Implement RLS policies and set buckets to private to prevent unauthorized access to uploaded resources: - Change 'resources' and 'avatars' buckets from public=true to public=false - Ensure only authenticated users can upload files - Ensure only authenticated users can read/download files - Ensure only file owners can delete their resources - Add comprehensive RLS policies for storage objects - Add IF NOT EXISTS to policies to prevent conflicts This prevents anonymous users from discovering or downloading shared resources through direct storage bucket access. Fixes durdana3105#1873 Signed-off-by: Anshul Jain <anshul23102@iiitd.ac.in>
Update Row-Level Security policies to prevent unauthorized enumeration of study rooms and access to private sessions: - Restrict study_rooms SELECT to: creator, participants, or public rooms - Enforce message access control based on room accessibility - Add participant lookup indexes for efficient RLS evaluation - Document enumeration prevention mechanisms Study room IDs already use UUID (non-sequential), but RLS policies were too permissive, allowing any authenticated user to enumerate all rooms. Fixes durdana3105#1872 Signed-off-by: Anshul Jain <anshul23102@iiitd.ac.in>
|
@anshul23102 is attempting to deploy a commit to the durdana3105's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@durdana3105 Thank you for reviewing! This PR fixes the session enumeration vulnerability by:
Study room IDs already use UUID (non-sequential), but the original RLS policy allowed any authenticated user to read all rooms, which was the real vulnerability. Could you please review and merge if it looks good? Also, please add the Let me know if any changes are needed! |
|
Warning Review limit reached
Next review available in: 54 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Update RLS policies to prevent unauthorized enumeration of study sessions. Restrict access to sessions based on creator, participant status, or public designation.
Changes
Security Impact
Prevents attackers from enumerating all study sessions and discovering private rooms through bulk queries.
Fixes #1872