Uh oh!
There was an error while loading. Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork 8
Feat/evault file manager#654
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Uh oh!
There was an error while loading. Please reload this page.
Changes from all commits
6db213150978ea3b7ee3724272fd657b1dde4456d4af30f951796a38File filter
Filter by extension
Conversations
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Uh oh!
There was an error while loading. Please reload this page.
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| { | ||
| "tableName": "files", | ||
| "schemaId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", | ||
| "ownerEnamePath": "users(owner.ename)", | ||
| "ownedJunctionTables": [], | ||
| "localToUniversalMap": { | ||
| "name": "name", | ||
| "displayName": "displayName", | ||
| "description": "description", | ||
| "mimeType": "mimeType", | ||
| "size": "size", | ||
| "md5Hash": "md5Hash", | ||
| "data": "data", | ||
| "ownerId": "users(owner.id),ownerId", | ||
| "createdAt": "__date(createdAt)", | ||
| "updatedAt": "__date(updatedAt)" | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| { | ||
| "tableName": "signature_containers", | ||
| "schemaId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", | ||
| "ownerEnamePath": "users(user.ename)", | ||
| "ownedJunctionTables": [], | ||
| "localToUniversalMap": { | ||
| "fileId": "files(file.id),fileId", | ||
| "userId": "users(user.id),userId", | ||
| "md5Hash": "md5Hash", | ||
| "signature": "signature", | ||
| "publicKey": "publicKey", | ||
| "message": "message", | ||
| "createdAt": "__date(createdAt)", | ||
| "updatedAt": "__date(updatedAt)" | ||
| } | ||
| } | ||
Comment on lines
+1
to
+16
Contributor There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. CRITICAL: This mapping file is identical to the one in file-manager-api. Both
This raises several concerns:
Verify the intended architecture and either:
| ||
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Critical: Race condition (TOCTOU) in single-use enforcement.
Between checking for existing signature containers (lines 31-33) and creating invitations (lines 52-96), concurrent requests can both pass the validation and proceed, violating the single-use constraint. This is a classic time-of-check to time-of-use vulnerability.
🔎 Recommended fix: Wrap in transaction with appropriate isolation
async inviteSignees( fileId: string, userIds: string[], invitedBy: string ): Promise<FileSignee[]> { + return await AppDataSource.transaction(async (transactionalEntityManager) => {+ const signatureRepository = transactionalEntityManager.getRepository(SignatureContainer);+ const fileRepository = transactionalEntityManager.getRepository(File);+ const fileSigneeRepository = transactionalEntityManager.getRepository(FileSignee);+ const userRepository = transactionalEntityManager.getRepository(User);+ // Verify file exists and user is owner - const file = await this.fileRepository.findOne({+ const file = await fileRepository.findOne({ where: { id: fileId, ownerId: invitedBy }, + lock: { mode: "pessimistic_write" }, }); if (!file) { throw new Error("File not found or user is not the owner"); } // Check if file already has signatures (single-use enforcement) - const existingSignatures = await this.signatureRepository.find({+ const existingSignatureCount = await signatureRepository.count({ where: { fileId }, }); - if (existingSignatures.length > 0) {+ if (existingSignatureCount > 0) { throw new Error("This file has already been used in a signature container and cannot be reused"); } // ... rest of the method using transactionalEntityManager repositories + }); }This approach:
count()instead offind()🤖 Prompt for AI Agents