fix(framework, types, medusa): add disallowed query config to restrict retrieved fields (#16125)

Author: shahednasser

.changeset/brown-bugs-sort.md

@@ -0,0 +1,7 @@
+---
+"@medusajs/framework": patch
+"@medusajs/types": patch
+"@medusajs/medusa": patch
+---
+
+fix(framework, types, medusa): add disallowed query config to restrict retrieved fields

packages/core/framework/src/http/utils/__tests__/get-query-config.spec.ts

@@ -573,4 +573,99 @@ describe("prepareListQuery", () => {
       })
     })
   })
+
+  describe("disallowed fields", () => {
+    it("should strip a disallowed top-level relation and its entire subtree", async () => {
+      const validated: RequestQueryFields = {
+        fields: "id,orders.email,orders.customer.first_name",
+        limit: 10,
+        offset: 0,
+      }
+
+      const queryConfig: QueryConfig<any> = {
+        entity: "region",
+        disallowed: ["orders", "customer"],
+        isList: true,
+      }
+
+      const result = await prepareListQuery(validated, queryConfig)
+
+      expect(result.remoteQueryConfig.fields).toEqual(["id"])
+    })
+
+    it("should strip a disallowed segment appearing at any depth", async () => {
+      const validated: RequestQueryFields = {
+        fields: "id,variants.order_items.order.total",
+        limit: 10,
+        offset: 0,
+      }
+
+      const queryConfig: QueryConfig<any> = {
+        entity: "product",
+        disallowed: ["order_items"],
+        isList: true,
+      }
+
+      const result = await prepareListQuery(validated, queryConfig)
+
+      expect(result.remoteQueryConfig.fields).toEqual(["id"])
+    })
+
+    it("should strip disallowed star fields", async () => {
+      const validated: RequestQueryFields = {
+        fields: "id,*orders",
+        limit: 10,
+        offset: 0,
+      }
+
+      const queryConfig: QueryConfig<any> = {
+        entity: "region",
+        disallowed: ["orders"],
+        isList: true,
+      }
+
+      const result = await prepareListQuery(validated, queryConfig)
+
+      expect(result.remoteQueryConfig.fields).toEqual(["id"])
+    })
+
+    it("should keep allowed fields that only share a prefix with a disallowed segment", async () => {
+      const validated: RequestQueryFields = {
+        fields: "id,order_id,customer_id",
+        limit: 10,
+        offset: 0,
+      }
+
+      const queryConfig: QueryConfig<any> = {
+        entity: "order",
+        disallowed: ["orders", "customer"],
+        isList: true,
+      }
+
+      const result = await prepareListQuery(validated, queryConfig)
+
+      expect(result.remoteQueryConfig.fields).toEqual([
+        "id",
+        "order_id",
+        "customer_id",
+      ])
+    })
+
+    it("should not remove anything when no disallowed fields are configured", async () => {
+      const validated: RequestQueryFields = {
+        fields: "id,orders.email",
+        limit: 10,
+        offset: 0,
+      }
+
+      const queryConfig: QueryConfig<any> = {
+        entity: "region",
+        isList: true,
+      }
+
+      const result = await prepareListQuery(validated, queryConfig)
+
+      expect(result.remoteQueryConfig.fields).toEqual(["id", "orders.email"])
+    })
+  })
 })

packages/core/framework/src/http/utils/field-filtering/field-validator.ts

@@ -81,3 +81,32 @@ export class RestrictedFieldFilter implements IFieldFilter {
     return notAllowedFields
   }
 }
+
+/**
+ * Filter that disallows specific fields as a hard security boundary.
+ * Any requested field whose path contains a disallowed segment is returned as
+ * not allowed (e.g. `orders` matches both `orders` and `orders.customer.email`).
+ * Behaves like {@link RestrictedFieldFilter}, but is enforced independently of
+ * any feature flag so it can be relied upon to keep sensitive relations off
+ * unauthenticated endpoints.
+ */
+export class DisallowedFieldFilter implements IFieldFilter {
+  private disallowed: string[]
+
+  constructor({ disallowed }: { disallowed: string[] }) {
+    this.disallowed = disallowed
+  }
+
+  getNotAllowedFields(context: FieldFilterContext): string[] {
+    const { parsedFields } = context
+    const { fields, starFields } = parsedFields
+    const fieldsToCheck = [...fields, ...Array.from(starFields)]
+
+    return fieldsToCheck.filter((field) => {
+      const fieldSegments = field.split(".")
+      return this.disallowed.some((disallowedField) =>
+        fieldSegments.includes(disallowedField)
+      )
+    })
+  }
+}

packages/core/framework/src/http/utils/field-filtering/index.ts

@@ -32,4 +32,8 @@ export interface IFieldFilter {
 }
 
 export { FieldParser } from "./field-parser"
-export { AllowedFieldFilter, RestrictedFieldFilter } from "./field-validator"
+export {
+  AllowedFieldFilter,
+  DisallowedFieldFilter,
+  RestrictedFieldFilter,
+} from "./field-validator"

packages/core/framework/src/http/utils/get-query-config.ts

@@ -13,6 +13,7 @@ import {
 import { AuthContext, MedusaRequest } from "../types"
 import {
   AllowedFieldFilter,
+  DisallowedFieldFilter,
   FieldParser,
   IFieldFilter,
   RestrictedFieldFilter,
@@ -43,9 +44,10 @@ export async function prepareListQuery<T extends RequestQueryFields, TEntity>(
     auth_context?: AuthContext
   }
 ) {
-  let {
+  const {
     allowed = [],
     restricted = [],
+    disallowed = [],
     defaults = [],
     defaultLimit = 50,
     isList,
@@ -97,12 +99,26 @@ export async function prepareListQuery<T extends RequestQueryFields, TEntity>(
     })
   }
 
+  // Disallowed fields are a hard security boundary and are always stripped,
+  // independent of any feature flag, so sensitive relations (order, customer,
+  // payment, ...) can never be resolved on the configured endpoint.
+  if (disallowed.length) {
+    const disallowedFields = new DisallowedFieldFilter({
+      disallowed,
+    }).getNotAllowedFields({ entity: entity as string, parsedFields })
+
+    disallowedFields.forEach((field) => {
+      allFields.delete(field)
+      starFields.delete(field)
+    })
+  }
+
   // TODO: maintain backward compatibility, remove in the future
   const { select, relations } = stringToSelectRelationObject(
     Array.from(allFields)
   )
 
-  let allRelations = new Set([...relations, ...Array.from(starFields)])
+  const allRelations = new Set([...relations, ...Array.from(starFields)])
 
   // End of expand compatibility
 
@@ -135,7 +151,7 @@ export async function prepareListQuery<T extends RequestQueryFields, TEntity>(
       withDeleted: with_deleted,
     },
     remoteQueryConfig: {
-      ...(!!entity ? { entity } : {}),
+      ...(entity ? { entity } : {}),
       // Add starFields that are relations only on which we want all properties with a dedicated format to the remote query
       fields: [
         ...Array.from(allFields),

packages/core/types/src/common/common.ts

@@ -459,6 +459,16 @@ export type QueryConfig<TEntity> = {
    * the authorization search.
    */
   allowed?: string[]
+  /**
+   * Fields and relations that must never be resolved, regardless of what the
+   * caller requests. Any requested field whose path contains one of these
+   * segments (e.g. `orders` matches `orders.customer.email`) is stripped before
+   * the query is executed. Unlike `allowed`, this is a hard security boundary
+   * that is always enforced, independent of any feature flag. Use it to keep
+   * sensitive relations (order, customer, payment, ...) off unauthenticated
+   * endpoints.
+   */
+  disallowed?: string[]
   defaultLimit?: number
   /**
    * If the route that will use that configuration is supposed to return a list of entities. This

packages/medusa/src/api/store/carts/query-config.ts

@@ -1,3 +1,5 @@
+import { disallowedStorePivotFields } from "../utils/disallowed-fields"
+
 // TODO: Global todo, review all default fields to prevent over fetching by default
 export const defaultStoreCartFields = [
   "id",
@@ -139,5 +141,9 @@ export const defaultStoreCartFields = [
 
 export const retrieveTransformQueryConfig = {
   defaults: defaultStoreCartFields,
+  // The cart legitimately exposes the caller's own customer/address/payment
+  // data during checkout, but must not be usable to pivot into other
+  // resources' order or cart data (e.g. region.orders, customer.orders).
+  disallowed: disallowedStorePivotFields,
   isList: false,
 }

packages/medusa/src/api/store/collections/query-config.ts

@@ -1,3 +1,5 @@
+import { disallowedStoreFields } from "../utils/disallowed-fields"
+
 export const defaultStoreCollectionFields = [
   "id",
   "title",
@@ -9,6 +11,7 @@ export const defaultStoreCollectionFields = [
 
 export const retrieveTransformQueryConfig = {
   defaults: defaultStoreCollectionFields,
+  disallowed: disallowedStoreFields,
   isList: false,
 }
 

packages/medusa/src/api/store/payment-providers/query-config.ts

@@ -1,6 +1,9 @@
+import { disallowedStoreFields } from "../utils/disallowed-fields"
+
 export const defaultAdminPaymentProviderFields = ["id", "is_enabled"]
 
 export const listTransformPaymentProvidersQueryConfig = {
   defaults: defaultAdminPaymentProviderFields,
+  disallowed: disallowedStoreFields,
   isList: true,
 }

packages/medusa/src/api/store/product-categories/query-config.ts

@@ -1,3 +1,5 @@
+import { disallowedStoreFields } from "../utils/disallowed-fields"
+
 export const defaults = [
   "id",
   "name",
@@ -15,11 +17,13 @@ export const defaults = [
 
 export const retrieveProductCategoryConfig = {
   defaults,
+  disallowed: disallowedStoreFields,
   isList: false,
 }
 
 export const listProductCategoryConfig = {
   defaults,
+  disallowed: disallowedStoreFields,
   defaultLimit: 50,
   isList: true,
 }