[PR #5897] [MERGED] fix(backend): resolve security advisories for IDOR and onboarding bypass #5402

New issue

Closed

opened 2026-03-17 02:51:13 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:51:13 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5897
Author: @mirarifhasan
Created: 2/22/2026
Status: ✅ Merged
Merged: 2/23/2026
Merged by: @jamesgeorge007

Base: next ← Head: fix/be-security-advisories

📝 Commits (4)

e366079 fix: prevent re-running onboarding; restrict env edits
3dc318d test: fix user environment test cases
aaa52ed fix(backend): improve error handling in onboarding status check
843da99 refactor(backend): extract inline error string and add missing JSDoc param

📊 Changes

6 files changed (+77 additions, -10 deletions)

View changed files

📝 packages/hoppscotch-backend/src/errors.ts (+14 -0)
📝 packages/hoppscotch-backend/src/infra-config/infra-config.service.ts (+12 -7)
📝 packages/hoppscotch-backend/src/infra-config/onboarding.controller.ts (+19 -0)
📝 packages/hoppscotch-backend/src/user-environment/user-environments.resolver.ts (+2 -0)
📝 packages/hoppscotch-backend/src/user-environment/user-environments.service.spec.ts (+19 -0)
📝 packages/hoppscotch-backend/src/user-environment/user-environments.service.ts (+11 -3)

📄 Description

Closes BE-717 BE-718

Fixes GHSA-jwv8-867r-q9fg
Fixes GHSA-72rv-vc3j-5vqr

What's changed

This PR addresses multiple security advisories by enforcing proper authorization checks.
1. https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg
2. https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-72rv-vc3j-5vqr
The canReRunOnboarding flag being tied to usersCount === 0 means the endpoint is only accessible when no users exist, so both the initial setup window and the re-run scenario are covered by the same guarantee. There's nothing meaningful to compromise in either case, and once the first user signs up it locks permanently.

On the other points from the report — the missing JWT/admin guard is intentional, since auth providers don't exist during initial setup and requiring auth to configure auth isn't feasible. The ask around guarding all /v1/onboarding/* endpoints also doesn't apply — GET /status has to stay public for the frontend to know whether to show the onboarding screen, and GET /config is already token-gated.
Additionally, getOnboardingStatus() previously always returned a success value, making the downstream E.isLeft check dead code. Wrapped in a try-catch so fetch failures now return a proper error and surface as HTTP 422.

Notes to reviewers

Nil

Summary by cubic

Fixes two security issues: blocks unauthorized onboarding re-runs and removes an IDOR in user environment mutations. Addresses GHSA-jwv8-867r-q9fg, GHSA-72rv-vc3j-5vqr, GHSA-57c6-hq5p-rgjq; completes BE-717 and BE-718.

Bug Fixes
- Onboarding: blocks re-run after completion; 400 when blocked, 422 on status fetch failure; uses ONBOARDING_CANNOT_BE_RERUN.
- User environments: scopes update/delete/clear to the authenticated user; resolver passes user to service; tests updated; adds missing JSDoc param.

^{Written for commit 843da99fbc. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5897 **Author:** [@mirarifhasan](https://github.com/mirarifhasan) **Created:** 2/22/2026 **Status:** ✅ Merged **Merged:** 2/23/2026 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `fix/be-security-advisories` --- ### 📝 Commits (4) - [`e366079`](https://github.com/hoppscotch/hoppscotch/commit/e36607925c4633486049d03baf7f151d1a6d9ef2) fix: prevent re-running onboarding; restrict env edits - [`3dc318d`](https://github.com/hoppscotch/hoppscotch/commit/3dc318d4628f1fbd82716aa4ee7c3832b7b86ec3) test: fix user environment test cases - [`aaa52ed`](https://github.com/hoppscotch/hoppscotch/commit/aaa52edb642835c9a8a2c7b643906cb78f0785f8) fix(backend): improve error handling in onboarding status check - [`843da99`](https://github.com/hoppscotch/hoppscotch/commit/843da99fbce13e11ebadc661fa5adf25ac6f686e) refactor(backend): extract inline error string and add missing JSDoc param ### 📊 Changes **6 files changed** (+77 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-backend/src/errors.ts` (+14 -0) 📝 `packages/hoppscotch-backend/src/infra-config/infra-config.service.ts` (+12 -7) 📝 `packages/hoppscotch-backend/src/infra-config/onboarding.controller.ts` (+19 -0) 📝 `packages/hoppscotch-backend/src/user-environment/user-environments.resolver.ts` (+2 -0) 📝 `packages/hoppscotch-backend/src/user-environment/user-environments.service.spec.ts` (+19 -0) 📝 `packages/hoppscotch-backend/src/user-environment/user-environments.service.ts` (+11 -3) </details> ### 📄 Description   Closes BE-717 BE-718 Fixes GHSA-jwv8-867r-q9fg Fixes GHSA-72rv-vc3j-5vqr  ### What's changed  - This PR addresses multiple security advisories by enforcing proper authorization checks. 1. https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg 2. https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-72rv-vc3j-5vqr The `canReRunOnboarding` flag being tied to `usersCount === 0` means the endpoint is only accessible when no users exist, so both the initial setup window and the re-run scenario are covered by the same guarantee. There's nothing meaningful to compromise in either case, and once the first user signs up it locks permanently. On the other points from the report — the missing JWT/admin guard is intentional, since auth providers don't exist during initial setup and requiring auth to configure auth isn't feasible. The ask around guarding all `/v1/onboarding/*` endpoints also doesn't apply — `GET /status` has to stay public for the frontend to know whether to show the onboarding screen, and `GET /config` is already token-gated. - Additionally, `getOnboardingStatus()` previously always returned a success value, making the downstream `E.isLeft` check dead code. Wrapped in a `try-catch` so fetch failures now return a proper error and surface as HTTP 422.  ### Notes to reviewers  Nil  --- ## Summary by cubic Fixes two security issues: blocks unauthorized onboarding re-runs and removes an IDOR in user environment mutations. Addresses GHSA-jwv8-867r-q9fg, GHSA-72rv-vc3j-5vqr, GHSA-57c6-hq5p-rgjq; completes BE-717 and BE-718. - **Bug Fixes** - Onboarding: blocks re-run after completion; 400 when blocked, 422 on status fetch failure; uses ONBOARDING_CANNOT_BE_RERUN. - User environments: scopes update/delete/clear to the authenticated user; resolver passes user to service; tests updated; adds missing JSDoc param. <sup>Written for commit 843da99fbce13e11ebadc661fa5adf25ac6f686e. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>