Firestore Transaction and Batched Write Vulnerabilities¶

// VULNERABLE: Authorization outside transaction
async function secureTransfer(fromAccount, toAccount, amount) {
  // Race condition: authorization check outside transaction
  const fromDoc = await db.collection('accounts').doc(fromAccount).get();
  if (fromDoc.data().owner !== currentUser.uid) {
    throw new Error('Unauthorized');
  }

  await db.runTransaction(async (transaction) => {
    const fromRef = db.collection('accounts').doc(fromAccount);
    const toRef = db.collection('accounts').doc(toAccount);

    const fromSnapshot = await transaction.get(fromRef);
    const currentBalance = fromSnapshot.data().balance;

    transaction.update(fromRef, { balance: currentBalance - amount });
    transaction.update(toRef, { balance: admin.firestore.FieldValue.increment(amount) });
  });
}

// SECURE: Authorization within transaction
async function secureTransfer(fromAccount, toAccount, amount) {
  await db.runTransaction(async (transaction) => {
    const fromRef = db.collection('accounts').doc(fromAccount);
    const toRef = db.collection('accounts').doc(toAccount);

    // Authorization check INSIDE transaction
    const fromSnapshot = await transaction.get(fromRef);
    const fromData = fromSnapshot.data();

    // Validate ownership within transaction
    if (fromData.owner !== currentUser.uid) {
      throw new Error('Unauthorized: Not account owner');
    }

    // Validate business rules
    if (fromData.balance < amount) {
      throw new Error('Insufficient funds');
    }

    if (amount <= 0) {
      throw new Error('Invalid transfer amount');
    }

    // Get target account and validate
    const toSnapshot = await transaction.get(toRef);
    if (!toSnapshot.exists) {
      throw new Error('Target account does not exist');
    }

    // Perform atomic updates
    transaction.update(fromRef, { 
      balance: fromData.balance - amount,
      lastModified: admin.firestore.FieldValue.serverTimestamp()
    });

    transaction.update(toRef, { 
      balance: admin.firestore.FieldValue.increment(amount),
      lastModified: admin.firestore.FieldValue.serverTimestamp()
    });

    // Log the transaction
    const logRef = db.collection('transaction_logs').doc();
    transaction.set(logRef, {
      from: fromAccount,
      to: toAccount,
      amount: amount,
      timestamp: admin.firestore.FieldValue.serverTimestamp(),
      initiatedBy: currentUser.uid
    });
  });
}

// VULNERABLE: No per-document authorization
async function bulkUpdateUsers(updates) {
  const batch = db.batch();

  updates.forEach(update => {
    const userRef = db.collection('users').doc(update.userId);
    batch.update(userRef, update.changes);
  });

  await batch.commit();
}

// SECURE: Validate each operation before batching
async function bulkUpdateUsers(updates) {
  // Pre-validate all operations
  const validatedUpdates = [];

  for (const update of updates) {
    // Check authorization for each document
    const userDoc = await db.collection('users').doc(update.userId).get();

    if (!userDoc.exists) {
      throw new Error(`User ${update.userId} does not exist`);
    }

    const userData = userDoc.data();

    // Verify user can modify this document
    if (userData.owner !== currentUser.uid && !isAdmin(currentUser)) {
      throw new Error(`Unauthorized to modify user ${update.userId}`);
    }

    // Validate the specific changes
    validateUserUpdateFields(update.changes, userData, currentUser);

    validatedUpdates.push(update);
  }

  // Only proceed if all validations pass
  const batch = db.batch();

  validatedUpdates.forEach(update => {
    const userRef = db.collection('users').doc(update.userId);
    const sanitizedChanges = sanitizeUserFields(update.changes);

    batch.update(userRef, {
      ...sanitizedChanges,
      lastModified: admin.firestore.FieldValue.serverTimestamp(),
      modifiedBy: currentUser.uid
    });
  });

  await batch.commit();
}

function validateUserUpdateFields(changes, currentData, user) {
  // Prevent privilege escalation
  if (changes.role && !isAdmin(user)) {
    throw new Error('Unauthorized to modify user role');
  }

  // Prevent balance manipulation
  if (changes.accountBalance && !isFinanceAdmin(user)) {
    throw new Error('Unauthorized to modify account balance');
  }

  // Validate data types and ranges
  if (changes.age && (typeof changes.age !== 'number' || changes.age < 0 || changes.age > 150)) {
    throw new Error('Invalid age value');
  }
}

function sanitizeUserFields(changes) {
  // Remove any system fields that shouldn't be directly modified
  const { createdAt, systemId, internalFlags, ...userFields } = changes;
  return userFields;
}