MokoConsulting/MokoSuiteBackup
1
0
Fork 0
Code Issues 28 Pull Requests Releases 2 Wiki Activity

fix: API backups endpoint leaks absolute_path in JSON response #187

New Issue
Open
opened 2026-06-29 14:41:04 +00:00 by jmiller · 3 comments
jmiller commented 2026-06-29 14:41:04 +00:00
Owner
Copy Link
Copy Source

Summary

api/src/Controller/BackupsController.php returns absolute_path in the JSON API response. This exposes the full server filesystem path to API consumers.

Location

source/packages/com_mokosuitebackup/api/src/Controller/BackupsController.php

Fix

Strip absolute_path from the API response object before returning. Keep it server-side only.

## Summary `api/src/Controller/BackupsController.php` returns `absolute_path` in the JSON API response. This exposes the full server filesystem path to API consumers. ## Location `source/packages/com_mokosuitebackup/api/src/Controller/BackupsController.php` ## Fix Strip `absolute_path` from the API response object before returning. Keep it server-side only.
jmiller added the component: admin label 2026-06-29 14:41:04 +00:00
jmiller commented 2026-06-29 14:41:09 +00:00
Author
Owner
Copy Link
Copy Source

Branch created: feature/187-fix-api-backups-endpoint-leaks-absolute-

git fetch origin
git checkout feature/187-fix-api-backups-endpoint-leaks-absolute-
Branch created: [`feature/187-fix-api-backups-endpoint-leaks-absolute-`](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteBackup/src/branch/feature/187-fix-api-backups-endpoint-leaks-absolute-) ```bash git fetch origin git checkout feature/187-fix-api-backups-endpoint-leaks-absolute- ```
jmiller commented 2026-07-05 19:25:26 +00:00
Author
Owner
Copy Link
Copy Source

🔍 Deep-dive triage (code @ 02.56.05) — VALID, but misattributed.

api/src/Controller/BackupsController.php does not emit absolute_path: profiles() strips sensitive fields (lines 125–140), download() streams binary. The real leak is the JSON:API serializer:

  • api/src/View/Backups/JsonapiView.php:27 — absolute_path is in $fieldsToRenderItem, so GET /v1/mokosuitebackup/backups/:id renders the full server filesystem path. $fieldsToRenderList (40–52) correctly omits it, so the list view is clean — only the item view leaks.

Severity: Low–Medium (authenticated info-disclosure; server path aids further attacks).
Fix: remove 'absolute_path' from $fieldsToRenderItem in JsonapiView.php (it's only needed server-side). Recommend retargeting this issue to that file.

🔍 **Deep-dive triage** (code @ 02.56.05) — **VALID, but misattributed.** `api/src/Controller/BackupsController.php` does **not** emit `absolute_path`: `profiles()` strips sensitive fields (lines 125–140), `download()` streams binary. The real leak is the JSON:API serializer: - **`api/src/View/Backups/JsonapiView.php:27`** — `absolute_path` is in `$fieldsToRenderItem`, so `GET /v1/mokosuitebackup/backups/:id` renders the full server filesystem path. `$fieldsToRenderList` (40–52) correctly omits it, so the **list** view is clean — only the **item** view leaks. **Severity:** Low–Medium (authenticated info-disclosure; server path aids further attacks). **Fix:** remove `'absolute_path'` from `$fieldsToRenderItem` in `JsonapiView.php` (it's only needed server-side). Recommend retargeting this issue to that file.
jmiller commented 2026-07-05 19:46:27 +00:00
Author
Owner
Copy Link
Copy Source

Still unfixed @ 02.56.05 — keep open, and the file target should be corrected.

The leak is not in BackupsController.php (its profiles() strips sensitive fields at 125-140; download() streams binary). The actual exposure is api/src/View/Backups/JsonapiView.php:27 — absolute_path is included in $fieldsToRenderItem, so GET /v1/mokosuitebackup/backups/:id returns the server filesystem path. $fieldsToRenderList (40-52) correctly omits it, so only the single-item view leaks. Fix: remove 'absolute_path' from $fieldsToRenderItem in JsonapiView.php:27.

Still unfixed @ 02.56.05 — keep open, and the file target should be corrected. The leak is not in `BackupsController.php` (its `profiles()` strips sensitive fields at 125-140; `download()` streams binary). The actual exposure is `api/src/View/Backups/JsonapiView.php:27` — `absolute_path` is included in `$fieldsToRenderItem`, so `GET /v1/mokosuitebackup/backups/:id` returns the server filesystem path. `$fieldsToRenderList` (40-52) correctly omits it, so only the single-item view leaks. Fix: remove `'absolute_path'` from `$fieldsToRenderItem` in `JsonapiView.php:27`.
Sign in to join this conversation.
Labels
Clear labels
component: admin
Admin UI and views
 component: api
REST API
 component: engine
Backup/restore engine
 component: remote
Remote storage (FTP/GDrive)
 component: scheduler
Scheduled tasks
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No labels component: admin
Priority Medium
Type Feature
Milestone
No items
No Milestone
Assignees
Clear assignees
jmiller (Jonathan Miller)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuiteBackup#187
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?