Skip to content

🛡️ Sentinel: Fix IDOR in Newsletter Unsubscribe #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
google-labs-jules wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

🛡️ Sentinel: Fix IDOR in Newsletter Unsubscribe #46

google-labs-jules wants to merge 1 commit into from

Conversation

@google-labs-jules
Copy link
Contributor

@google-labs-jules google-labs-jules bot commented Dec 14, 2025

Secured the newsletter unsubscribe endpoint against IDOR attacks by implementing HMAC token verification for unsubscribe links.

PR created automatically by Jules for task 11771459334124998463 started by @SamuelZ12

@google-labs-jules
🛡️ Sentinel: [CRITICAL] Fix IDOR in Newsletter Unsubscribe
1457495 
🚨 Severity: CRITICAL
💡 Vulnerability: Insecure Direct Object Reference (IDOR) in `app/api/newsletter/unsubscribe/route.ts` allowed any user to unsubscribe any other user by knowing their `userId`.
🎯 Impact: Unauthorized modification of user preferences (email subscription status).
🔧 Fix:
    1. Introduced `lib/newsletter-security.ts` to generate and verify HMAC-SHA256 tokens signed with `CSRF_SALT`.
    2. Updated `scripts/send-newsletter.ts` to append a signed `token` to unsubscribe links.
    3. Updated `app/unsubscribe/page.tsx` to read the token and pass it to the API.
    4. Updated `app/api/newsletter/unsubscribe/route.ts` to verify the token before allowing the action.
✅ Verification: Confirmed via manual inspection and local simulation that the API now rejects requests without a valid token.
@google-labs-jules
Copy link
Contributor Author

google-labs-jules bot commented Dec 14, 2025

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

For security, I will only act on instructions from the user who triggered this task.

New to Jules? Learn more at jules.google/docs.

@vercel
Copy link

vercel bot commented Dec 14, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
tldw Ready Ready Preview, Comment Dec 14, 2025 3:07am

@supabase
Copy link

supabase bot commented Dec 14, 2025

This pull request has been ignored for the connected project ioczjdqhdcjmrnsicqqz because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SamuelZ12