Fix: Prevent identity spoofing in document creation by enforcing server-side ownership#12153
Conversation
Greptile SummaryThis PR attempts to prevent identity spoofing in document creation by stripping client-provided identity fields and enforcing server-side ownership via Confidence Score: 0/5Not safe to merge — the PR breaks server-token/API-key document creation, silently drops legitimate user-defined collection attributes, and conflicts with the database layer's authoritative ownership assignment. Multiple P0 issues are present: the early isEmpty() guard completely blocks API-key and admin server-token requests (a fully supported auth mode declared in the SDK metadata), unsetting userId, ownerId, and permissions destroys user data in any collection that legitimately uses those attribute names, and overwriting $createdBy at the application layer conflicts with the existing database-layer assignment and silently sets it to an empty string for API-key sessions. src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Create.php requires a full re-review of the ownership-enforcement approach. Important Files Changed
Reviews (3): Last reviewed commit: "Merge branch '1.9.x' into fix-createdby-..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| $document['userId'], | ||
| $document['createdBy'], | ||
| $document['ownerId'], | ||
| $document['permissions'] |
There was a problem hiding this comment.
permissions corrupts user-defined fields
permissions (without the $ prefix) is not a system-reserved field — the actual Appwrite system field is $permissions. Any user collection that has an attribute literally named permissions will have that field silently dropped from every document being created. Only $-prefixed system fields should be stripped here.
1 participant
What does this PR do?
This PR prevents identity spoofing during document creation by enforcing server-side ownership.
It removes trust from client-provided identity fields (
$createdBy,$owner,ownerId,userId) and ensures ownership is always derived from the authenticated user session only.This fixes a security issue where malicious clients could attempt to impersonate other users by injecting identity fields in the request payload.
Test Plan
$createdByis automatically set to the authenticated user ID.$createdBy,userId, etc.).$createdByisnullwhen no user session exists.Related PRs and Issues
Checklist