Security notes about deepstream.io-provider-search-rethinkdb HOT 7 OPEN

const ConfigPermissionHandler = require('deepstream.io/src/permission/config-permission-handler')

...

// Wrapper around ConfigPermissionHandler to handle verifying searches ourselves.
class CustomPermissionsHandler extends ConfigPermissionHandler {
  constructor () {
    // Deepstream already needs to be initialized, and the permissions configuration needs to be passed or in the options object.
    super(deepstream._options, require('./deepstream-config/permissions.json'))
  }

  // This is the important part.
  canPerformAction (username, message, callback, authData) {
    // Special logic if this is a search query.
    if (message.data && message.data[0] && message.data[0].indexOf('search?') !== -1) {
      try {
        // Parse the query payload.
        const searchPayload = JSON.parse(message.data[0].split('?')[1])

        // Create a new message replacing the search query with the target table name.
        const tableMessage = Object.assign({}, message)
        tableMessage.data = [searchPayload.table, searchPayload]

        Promise.all([
          // Run permissions checker twice, first for the search query message, then for the table access message.
          new Promise((resolve, reject) => {
            super.canPerformAction(username, message, (...args) => {
              resolve(args)
            }, authData)
          }),
          new Promise((resolve, reject) => {
            super.canPerformAction(username, tableMessage, (...args) => {
              resolve(args)
            }, authData)
          })
        ])
        .then(results => {
          // If any of those results are false, deny the request.
          const finalAllowDeny = results.reduce((acc, result) => acc && result[1], true)

          // results[0] is the most "accurate" permission check, so use any metadata for that that comes through.
          callback(results[0][0], finalAllowDeny)
        })
      } catch (e) {
        // Handle permission errors here. Passing false denies the request attempt.
        callback('Permissions Validation Error.', false)
      }
    // Otherwise pass it on to the normal handler.
    } else {
      super.canPerformAction(username, message, (...args) => {
        callback(...args)
      }, authData)
    }
  }
}

...

deepstream.set('permissionHandler', new CustomPermissionsHandler())