Skip to content

Prevent IDOR Takeover of DocumentStores#5914

Merged
yau-wd merged 6 commits intomainfrom
document-store-idor
Mar 10, 2026
Merged

Prevent IDOR Takeover of DocumentStores#5914
yau-wd merged 6 commits intomainfrom
document-store-idor

Conversation

@christopherholland-workday
Copy link
Contributor

FLOWISE-260

@FlowiseAI FlowiseAI deleted a comment from gemini-code-assist bot Mar 5, 2026
gemini-code-assist[bot]

This comment was marked as outdated.

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
@christopherholland-workday christopherholland-workday marked this pull request as ready for review March 6, 2026 01:14
updateDocStore.embeddingConfig = body.embeddingConfig ?? null
updateDocStore.recordManagerConfig = body.recordManagerConfig ?? null
updateDocStore.loaders = body.loaders ?? '[]'
updateDocStore.whereUsed = body.whereUsed ?? '[]'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Data Loss Bug: Updating Name Wipes Data

Before Update After Update
Image Image Image Image

Solution: Only assign fields when defined

if (body.description !== undefined) updateDocStore.description = body.description

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added checks for all fields

@yau-wd yau-wd merged commit 840d2ae into main Mar 10, 2026
7 checks passed
@yau-wd yau-wd deleted the document-store-idor branch March 10, 2026 05:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants