Improve security

src/reader/delete_feed.rs

@@ -2,21 +2,25 @@ use actix_web::{web, HttpResponse};
 use diesel::prelude::*;
 
 use crate::{
+    auth::extractor::AuthUser,
     database::establish_connection,
     schema::{feed, feed_item},
 };
 
-pub async fn delete_feed(path: web::Path<i32>) -> HttpResponse {
+pub async fn delete_feed(path: web::Path<i32>, auth_user: AuthUser) -> HttpResponse {
     let feed_id = path.into_inner();
     let mut connection = establish_connection();
 
-    let exists = feed::table
+    let owner: Option<i32> = feed::table
         .find(feed_id)
-        .count()
-        .get_result::<i64>(&mut connection)
-        .unwrap_or(0);
+        .select(feed::user_id)
+        .first(&mut connection)
+        .optional()
+        .unwrap_or(None);
 
-    if exists == 0 {
+    // Treat "doesn't exist" and "not yours" the same, so callers can't probe
+    // for other users' feed ids.
+    if owner != Some(auth_user.0) {
         return HttpResponse::NotFound().finish();
     }
 
@@ -33,11 +37,13 @@ pub async fn delete_feed(path: web::Path<i32>) -> HttpResponse {
 
 #[cfg(test)]
 mod tests {
+    use actix_service::Service;
     use actix_web::http::StatusCode;
-    use actix_web::{test, web, App};
+    use actix_web::{test, web, App, HttpMessage};
     use diesel::prelude::*;
 
     use super::delete_feed;
+    use crate::auth::extractor::AuthUser;
     use crate::database::establish_connection;
     use crate::schema::{feed, feed_item};
     use crate::test_helpers::{
@@ -51,8 +57,14 @@ mod tests {
         let f = insert_feed(&mut connection, user.id);
         let item = insert_feed_item(&mut connection, f.id, false);
 
+        let user_id = user.id;
         let app = test::init_service(
-            App::new().route("/feed/{feed_id}", web::delete().to(delete_feed)),
+            App::new()
+                .wrap_fn(move |req, srv| {
+                    req.extensions_mut().insert(AuthUser(user_id));
+                    srv.call(req)
+                })
+                .route("/feed/{feed_id}", web::delete().to(delete_feed)),
         )
         .await;
         let req = test::TestRequest::delete()
@@ -82,7 +94,12 @@ mod tests {
     #[actix_web::test]
     async fn delete_feed_returns_404_for_nonexistent_feed() {
         let app = test::init_service(
-            App::new().route("/feed/{feed_id}", web::delete().to(delete_feed)),
+            App::new()
+                .wrap_fn(move |req, srv| {
+                    req.extensions_mut().insert(AuthUser(1));
+                    srv.call(req)
+                })
+                .route("/feed/{feed_id}", web::delete().to(delete_feed)),
         )
         .await;
         let req = test::TestRequest::delete()
@@ -100,8 +117,14 @@ mod tests {
         let feed_a = insert_feed(&mut connection, user.id);
         let feed_b = insert_feed(&mut connection, user.id);
 
+        let user_id = user.id;
         let app = test::init_service(
-            App::new().route("/feed/{feed_id}", web::delete().to(delete_feed)),
+            App::new()
+                .wrap_fn(move |req, srv| {
+                    req.extensions_mut().insert(AuthUser(user_id));
+                    srv.call(req)
+                })
+                .route("/feed/{feed_id}", web::delete().to(delete_feed)),
         )
         .await;
         let req = test::TestRequest::delete()
@@ -121,4 +144,40 @@ mod tests {
         cleanup_feed(&mut connection, feed_b.id);
         delete_user(&mut connection, user.id);
     }
+
+    #[actix_web::test]
+    async fn delete_feed_rejects_other_users_feed() {
+        let mut connection = establish_connection();
+        let user_a = insert_user(&mut connection, "secret");
+        let user_b = insert_user(&mut connection, "secret");
+        let feed_b = insert_feed(&mut connection, user_b.id);
+
+        let user_a_id = user_a.id;
+        let app = test::init_service(
+            App::new()
+                .wrap_fn(move |req, srv| {
+                    req.extensions_mut().insert(AuthUser(user_a_id));
+                    srv.call(req)
+                })
+                .route("/feed/{feed_id}", web::delete().to(delete_feed)),
+        )
+        .await;
+        let req = test::TestRequest::delete()
+            .uri(&format!("/feed/{}", feed_b.id))
+            .to_request();
+        let resp = test::call_service(&app, req).await;
+
+        assert_eq!(StatusCode::NOT_FOUND, resp.status());
+
+        let feed_b_exists: i64 = feed::table
+            .filter(feed::id.eq(feed_b.id))
+            .count()
+            .get_result(&mut connection)
+            .unwrap();
+        assert_eq!(1, feed_b_exists);
+
+        cleanup_feed(&mut connection, feed_b.id);
+        delete_user(&mut connection, user_a.id);
+        delete_user(&mut connection, user_b.id);
+    }
 }