PadMessageHandler: prohibit reading of message.data.padId

2022-02-24 00:14:25 +01:00
1 changed files with 6 additions and 0 deletions
--- a/src/node/handler/PadMessageHandler.js
+++ b/src/node/handler/PadMessageHandler.js
@ -250,6 +250,12 @@ exports.handleMessage = async (socket, message) => {
    throw new Error('message.padId must not be accessed (for security reasons)');
  }});

+  if (message.data) {
+    Object.defineProperty(message.data, 'padId', {get: () => {
+      throw new Error('message.data.padId must not be accessed (for security reasons)');
+    }});
+  }
+
  const auth = thisSession.auth;
  if (!auth) {
    const ip = settings.disableIPlogging ? 'ANONYMOUS' : (socket.request.ip || '<unknown>');