doc COPY requests allow bypass of ID validity check

[alxndrsn]

doc COPY requests allow bypass of ID validity check

[big-r81]

Hey,

what do you mean by „with illegal IDs“ and „ID validity check”? Can you give a concrete example what’s going wrong?

[alxndrsn]

Can you give a concrete example what’s going wrong?

Setup

docker run --detach --network host --rm -e COUCHDB_USER=admin -e COUCHDB_PASSWORD=password -it --name my-couchdb-$RANDOM apache/couchdb &&
sleep 5 &&
curl http://admin:password@localhost:5984/main -X PUT && curl http://admin:password@localhost:5984/_users -X PUT

Create legal doc (PUT)

$ curl http://admin:password@localhost:5984/main/some-valid-doc-id -X PUT -H 'content-type: application/json' --data '{"hi":true}'
{"ok":true,"id":"some-valid-doc-id","rev":"1-e7e9148335bb3e3d0f04263e57edef01"}

Try to create illegal doc (PUT)

$ curl http://admin:password@localhost:5984/main/_bad_path -X PUT -H 'content-type: application/json' --data '{"hi":true}'
{"error":"illegal_docid","reason":"Only reserved document ids may start with underscore."}

Create illegal doc (COPY)

$ curl http://admin:password@localhost:5984/main/some-valid-doc-id -X COPY -H 'Destination: _bad_path'
{"ok":true,"id":"_bad_path","rev":"1-e7e9148335bb3e3d0f04263e57edef01"}

Retrieve illegal doc (GET)

$ curl http://admin:password@localhost:5984/main/_bad_path
{"_id":"_bad_path","_rev":"1-e7e9148335bb3e3d0f04263e57edef01","hi":true}

[alxndrsn]

This creates some weird situations, e.g.

$ curl http://admin:password@localhost:5984/main/some-valid-doc-id -X COPY -H 'Destination: _all_docs'
{"ok":true,"id":"_all_docs","rev":"1-e7e9148335bb3e3d0f04263e57edef01"}

$ curl http://admin:password@localhost:5984/main/_all_docs
{"total_rows":3,"offset":0,"rows":[
{"id":"_all_docs","key":"_all_docs","value":{"rev":"1-e7e9148335bb3e3d0f04263e57edef01"}},
{"id":"_bad_path","key":"_bad_path","value":{"rev":"1-e7e9148335bb3e3d0f04263e57edef01"}},
{"id":"some-valid-doc-id","key":"some-valid-doc-id","value":{"rev":"1-e7e9148335bb3e3d0f04263e57edef01"}}
]}

[big-r81]

Thx 🙏 for giving an example and that doesn’t look good…