Inclusion filter present security issue

[offlinehacker]

So let's say i have following relation user <-groupMembers-> group, now if i allow group owner to query users, he can also include all user tokens, and login as user, nice.

[raymondfeng]

Hmm, this is serious. I think the ACL will have to check the permissions for the included relations.

[fabien]

@raymondfeng I believe this has been fixed, no?

[grosem]

@fabien & @raymondfeng

I just tested it with the latest version and it is still possible. For example like this (manager is extending the User model):

http://localhost:3000/api/events?filter={"where":{"nr":1},"include":{"relation":"manager","scope":{"include":[{"relation":"accessTokens"}]}}}

https://groups.google.com/forum/#!topic/loopbackjs/8XmsoaHpNP4 seems to be the same problem.

[fabien]

ping @raymondfeng @bajtos @ritch

[bajtos]

@raymondfeng mentioned in the mailing list that one can disable includes in model/relation settings using the option disableInclude: true. Does that fix the problem?

Is it enough to change configuration of the built-in relation "User hasMany accessTokens" to prevent inclusion? Or is that just a workaround and we need to implement @raymondfeng proposal "the ACL will have to check the permissions for the included relations"?

[grosem]

From my point of view this should definitely covered by ACL.

[raymondfeng]

@bajtos User.hasMany accessTokens probably should have disableInclude set to true by default.

[bajtos]

Closing the issue as fixed by #1318.