[PR #5902] [MERGED] fix(backend): prevent IDOR in user collection and request endpoints #5408

New issue

Closed

opened 2026-03-17 02:51:29 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:51:29 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5902
Author: @mirarifhasan
Created: 2/24/2026
Status: ✅ Merged
Merged: 2/24/2026
Merged by: @jamesgeorge007

Base: next ← Head: fix/GHSA-m5pg-r4jp-qq75

📝 Commits (2)

e220eda chore: require user UID for user collection lookups
e914061 chore: remove redundant ownership checks and add test

📊 Changes

10 files changed (+329 additions, -230 deletions)

View changed files

📝 packages/hoppscotch-backend/src/errors.ts (+2 -4)
📝 packages/hoppscotch-backend/src/team-collection/team-collection.service.spec.ts (+10 -21)
📝 packages/hoppscotch-backend/src/team-collection/team-collection.service.ts (+72 -42)
📝 packages/hoppscotch-backend/src/team-request/team-request.service.ts (+32 -17)
📝 packages/hoppscotch-backend/src/user-collection/user-collection.resolver.ts (+5 -2)
📝 packages/hoppscotch-backend/src/user-collection/user-collection.service.spec.ts (+72 -45)
📝 packages/hoppscotch-backend/src/user-collection/user-collection.service.ts (+95 -74)
📝 packages/hoppscotch-backend/src/user-environment/user-environments.resolver.ts (+1 -1)
📝 packages/hoppscotch-backend/src/user-request/user-request.service.spec.ts (+1 -0)
📝 packages/hoppscotch-backend/src/user-request/user-request.service.ts (+39 -24)

📄 Description

Closes BE-722

What's changed

This PR fixes a security vulnerability (GHSA-m5pg-r4jp-qq75) where Insecure Direct Object Reference (IDOR) allowed authenticated users to access, resources belonging to other users by manipulating user-collection.

Notes to reviewers

Nil

Summary by cubic

Adds strict user ownership validation to user collections and requests to prevent IDOR (GHSA-m5pg-r4jp-qq75). All lookups and move/reorder/delete operations are now scoped to the authenticated user or team. Closes BE-722.

Bug Fixes
- Required userUid in getUserCollection and updated all callers (UserCollectionService, UserRequestService, GraphQL resolvers, tests) to pass user.uid; removed redundant ownership checks and return USER_COLL_NOT_FOUND for cross-user IDs.
- Enforced ownership across move/reorder/delete/duplicate flows; added transactional locks and corrected updateMany filters to include userUid/teamID, preventing cross-user/team side effects; added tests.
Migration
- Internal API change: getUserCollection(collectionID, userUid, tx?). fetchCollectionData now also requires userID. Callers must pass the current user UID. No external API changes.

^{Written for commit e914061a55. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5902 **Author:** [@mirarifhasan](https://github.com/mirarifhasan) **Created:** 2/24/2026 **Status:** ✅ Merged **Merged:** 2/24/2026 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `fix/GHSA-m5pg-r4jp-qq75` --- ### 📝 Commits (2) - [`e220eda`](https://github.com/hoppscotch/hoppscotch/commit/e220eda1df266f21fd623a3a220495d947e8b5e7) chore: require user UID for user collection lookups - [`e914061`](https://github.com/hoppscotch/hoppscotch/commit/e914061a5520eafe488eb73fbfb850af4a4e84ec) chore: remove redundant ownership checks and add test ### 📊 Changes **10 files changed** (+329 additions, -230 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-backend/src/errors.ts` (+2 -4) 📝 `packages/hoppscotch-backend/src/team-collection/team-collection.service.spec.ts` (+10 -21) 📝 `packages/hoppscotch-backend/src/team-collection/team-collection.service.ts` (+72 -42) 📝 `packages/hoppscotch-backend/src/team-request/team-request.service.ts` (+32 -17) 📝 `packages/hoppscotch-backend/src/user-collection/user-collection.resolver.ts` (+5 -2) 📝 `packages/hoppscotch-backend/src/user-collection/user-collection.service.spec.ts` (+72 -45) 📝 `packages/hoppscotch-backend/src/user-collection/user-collection.service.ts` (+95 -74) 📝 `packages/hoppscotch-backend/src/user-environment/user-environments.resolver.ts` (+1 -1) 📝 `packages/hoppscotch-backend/src/user-request/user-request.service.spec.ts` (+1 -0) 📝 `packages/hoppscotch-backend/src/user-request/user-request.service.ts` (+39 -24) </details> ### 📄 Description    Closes BE-722  ### What's changed  This PR fixes a security vulnerability ([GHSA-m5pg-r4jp-qq75](https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-m5pg-r4jp-qq75)) where Insecure Direct Object Reference (IDOR) allowed authenticated users to access, resources belonging to other users by manipulating `user-collection`.  ### Notes to reviewers  Nil  --- ## Summary by cubic Adds strict user ownership validation to user collections and requests to prevent IDOR (GHSA-m5pg-r4jp-qq75). All lookups and move/reorder/delete operations are now scoped to the authenticated user or team. Closes BE-722. - **Bug Fixes** - Required userUid in getUserCollection and updated all callers (UserCollectionService, UserRequestService, GraphQL resolvers, tests) to pass user.uid; removed redundant ownership checks and return USER_COLL_NOT_FOUND for cross-user IDs. - Enforced ownership across move/reorder/delete/duplicate flows; added transactional locks and corrected updateMany filters to include userUid/teamID, preventing cross-user/team side effects; added tests. - **Migration** - Internal API change: getUserCollection(collectionID, userUid, tx?). fetchCollectionData now also requires userID. Callers must pass the current user UID. No external API changes. <sup>Written for commit e914061a5520eafe488eb73fbfb850af4a4e84ec. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>