jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-21 09:05:10 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[Security] Redact sensitive user data from client-visible responses (#7077)

Browse source 
The getUserInfo command for a user that is not currently online returned
the full database record, including the account id, the email address
and the stored client id, to any logged-in requester. Mirror the
redaction already applied to online users via copyUserInfo(): the id and
email are only ever exposed to the account owner, and the client id only
to moderators.

The buddy/ignore add-to-list event likewise returned the target user's
email address and client id to the requester. The list entry only needs
the public profile fields, so strip the email and client id from it as
well.

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
This commit is contained in:
BruebachL 2026-08-08 17:32:39 +02:00 • committed by GitHub
parent 0d14fb77a0
commit 27fb5e51de
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
libcockatrice_network/libcockatrice/network/server/remote/server_protocolhandler.cpp
View file

@ -685,6 +685,15 @@ Response::ResponseCode Server_ProtocolHandler::cmdGetUserInfo(const Command_GetU
ServerInfo_User_Container *infoSource = server->findUser(userName); ServerInfo_User_Container *infoSource = server->findUser(userName);
if (!infoSource) { if (!infoSource) {
re->mutable_user_info()->CopyFrom(databaseInterface->getUserData(userName, true)); re->mutable_user_info()->CopyFrom(databaseInterface->getUserData(userName, true));
// The user is not currently online. Mirror the redaction that
// copyUserInfo() applies to online users: the id and email address
// are only ever visible to the account owner, and the client id
// only to moderators.
re->mutable_user_info()->clear_id();
re->mutable_user_info()->clear_email();
if (!(userInfo->user_level() & ServerInfo_User::IsModerator)) {
re->mutable_user_info()->clear_clientid();
}
} else { } else {
re->mutable_user_info()->CopyFrom( re->mutable_user_info()->CopyFrom(
infoSource->copyUserInfo(true, false, userInfo->user_level() & ServerInfo_User::IsModerator)); infoSource->copyUserInfo(true, false, userInfo->user_level() & ServerInfo_User::IsModerator));

4
servatrice/src/serversocketinterface.cpp
View file

@ -325,6 +325,10 @@ Response::ResponseCode AbstractServerSocketInterface::cmdAddToList(const Command
Event_AddToList event; Event_AddToList event;
event.set_list_name(cmd.list()); event.set_list_name(cmd.list());
event.mutable_user_info()->CopyFrom(databaseInterface->getUserData(user)); event.mutable_user_info()->CopyFrom(databaseInterface->getUserData(user));
// The buddy/ignore list entry is only used to display the user's basic
// profile: never leak the target's email address or client id.
event.mutable_user_info()->clear_email();
event.mutable_user_info()->clear_clientid();
rc.enqueuePreResponseItem(ServerMessage::SESSION_EVENT, prepareSessionEvent(event)); rc.enqueuePreResponseItem(ServerMessage::SESSION_EVENT, prepareSessionEvent(event));
return Response::RespOk; return Response::RespOk;