Security: Restrict leaderboard score updates to server-side functions - #1880
Security: Restrict leaderboard score updates to server-side functions#1880anshul23102 wants to merge 4 commits into
Conversation
Implement input sanitization for all message types to prevent stored XSS attacks: - Add sanitize.ts utility module using DOMPurify for consistent sanitization - Sanitize user messages before storing in useMessages.ts - Sanitize room chat messages in useRoomChat.ts - Sanitize chatbot messages in useChatbot.ts This ensures malicious content cannot be stored in the database or rendered to other users, protecting against stored XSS vulnerabilities. Fixes durdana3105#1874 Signed-off-by: Anshul Jain <anshul23102@iiitd.ac.in>
Implement RLS policies and set buckets to private to prevent unauthorized access to uploaded resources: - Change 'resources' and 'avatars' buckets from public=true to public=false - Ensure only authenticated users can upload files - Ensure only authenticated users can read/download files - Ensure only file owners can delete their resources - Add comprehensive RLS policies for storage objects - Add IF NOT EXISTS to policies to prevent conflicts This prevents anonymous users from discovering or downloading shared resources through direct storage bucket access. Fixes durdana3105#1873 Signed-off-by: Anshul Jain <anshul23102@iiitd.ac.in>
Update Row-Level Security policies to prevent unauthorized enumeration of study rooms and access to private sessions: - Restrict study_rooms SELECT to: creator, participants, or public rooms - Enforce message access control based on room accessibility - Add participant lookup indexes for efficient RLS evaluation - Document enumeration prevention mechanisms Study room IDs already use UUID (non-sequential), but RLS policies were too permissive, allowing any authenticated user to enumerate all rooms. Fixes durdana3105#1872 Signed-off-by: Anshul Jain <anshul23102@iiitd.ac.in>
Implement RLS policies and audit logging to prevent users from directly modifying their scores: - Restrict UPDATE policy to only allow profile field changes (username, avatar) - Prevent direct updates to xp, streak, badges, sessions_joined fields - Require server-side functions (increment_xp, award_badge) for score changes - Add leaderboard_updates audit table to log all score modifications - Create trigger to automatically log score changes - Users cannot access audit log (RLS prevents SELECT) This prevents users from arbitrarily boosting their XP, adding unearned badges, or manipulating their ranking through client-side code. Fixes durdana3105#1871 Signed-off-by: Anshul Jain <anshul23102@iiitd.ac.in>
|
@anshul23102 is attempting to deploy a commit to the durdana3105's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@durdana3105 Thank you for reviewing! This PR secures the leaderboard by:
The gamification system's integrity depends on trusting server-side scoring, not client-side updates. Could you please review and merge if it looks good? Also, please add the Let me know if any changes are needed! |
|
Warning Review limit reached
Next review available in: 53 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (10)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Implement strict RLS policies and audit logging to prevent users from directly modifying their leaderboard scores through client-side code.
Changes
Security Impact
Prevents score manipulation: users cannot arbitrarily boost XP, add unearned badges, or manipulate rankings through client-side Supabase calls.
Fixes #1871