Skip to content

fix: casl ability rules are defined and updated enti... in ability.js #4511

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anupamme wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix: casl ability rules are defined and updated enti... in ability.js #4511

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/lib/helpers/ability.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ export const ability = toReactiveAbility(createMongoAbility([]));
* @returns {void}
*/
export const updateAbilities = (rules) => {
if (!Array.isArray(rules)) return;

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Clear stale abilities when rejecting invalid payloads.

The early return leaves the existing rules untouched. Since signin, token refresh, and organization switching call this helper for any truthy abilities value, a truthy non-array response can preserve the previous user’s or organization’s permissions. Reset to [] or treat the response as invalid and fail the transition.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/helpers/ability.js` at line 46, Update the rules validation in the
ability helper so a truthy non-array abilities payload cannot retain existing
permissions. Before returning from the invalid-payload branch, clear the current
rules to [] or reject the transition using the helper’s established
invalid-response behavior.

🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Files:"
git ls-files | rg '(^|/)ability\.js$|package\.json$|package-lock\.json$' || true

echo
echo "ability.js outline/content:"
if [ -f src/lib/helpers/ability.js ]; then
  wc -l src/lib/helpers/ability.js
  cat -n src/lib/helpers/ability.js
fi

echo
echo "Search updateAbilities usages:"
rg -n "updateAbilities|abilities|createAbility|update" src || true

Repository: pierreb-devkit/Vue

Length of output: 48000

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "auth.store relevant sections:"
sed -n '130,170p;328,350p' src/modules/auth/stores/auth.store.js

echo
echo "organizations.store relevant sections:"
sed -n '110,135p' src/modules/organizations/stores/organizations.store.js

echo
echo "ability tests relevant sections:"
sed -n '1,80p' src/lib/helpers/tests/ability.unit.tests.js

echo
echo "Lockfile `@casl` packages:"
python3 - <<'PY'
import json
p=json.load(open('package-lock.json'))
for k,v in (p.get('packages') or {}).items():
    if k.startswith('node_modules/@casl/') and not k.startswith('node_modules/@casl/ability'):
        print(k, v.get('version'))
PY

Repository: pierreb-devkit/Vue

Length of output: 6482

🌐 Web query:

@casl/ability createMongoAbility can manage all subject action manage all

💡 Result:

In the CASL authorization library, manage and all are special, built-in keywords [1][2]. When used together as can('manage', 'all'), they create a wildcard permission that grants full access to all actions on all subjects [3][1]. 1. manage: A special action keyword that represents any action [1][2]. 2. all: A special subject keyword that represents any subject [1][2]. When you define an ability using createMongoAbility, such as: import { AbilityBuilder, createMongoAbility } from '@casl/ability'; const { can, build } = new AbilityBuilder(createMongoAbility); can('manage', 'all'); // Grants full access to everything const ability = build; The resulting ability instance will return true for any check, such as ability.can('read', 'AnySubject') or ability.can('delete', 'OtherSubject') [1]. You can restrict this broad permission by using the cannot method, which takes precedence over can rules [1][2]. For example, can('manage', 'all') followed by cannot('delete', 'User') would allow everything except deleting users [1].

Citations:

Do not treat this guard as an authorization fix.

Array.isArray still accepts attacker-controlled rules such as { action: 'manage', subject: 'all' }, and ability.update() installs them as full client-side permissions. Enforce authorization independently on every sensitive backend operation; client-side CASL is only for UI behavior.

The current signin, token refresh, and organization switch flows call updateAbilities() directly when the response contains abilities, so this helper cannot be a security boundary.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/helpers/ability.js` at line 46, The Array.isArray guard in the
ability helper must not be treated as authorization. Keep client-side
updateAbilities behavior limited to UI state, and enforce authorization
independently within every sensitive backend operation, including signin, token
refresh, and organization-switch flows that consume abilities.

ability.update(rules);
};

Expand Down