Special FieldValues not properly checked - major security risk

[Joebayld]

Special FieldValues not properly checked - major security risk

[Joebayld]

Just an update -

Did some digging and it found the issue resides in the serializeSpecialTypes function. Seems like when checking if the data is an instanceOf a FieldValue, all those checks fail as the instanceOf fail. Why? I think because it's checking it's own instance of firebase-admin and not the library in your project. It shouldn't even install firebase-admin as a dependency if the project is also using it..

This can end up EXTREMELY DANGEROUS. I did some digging and when you are exporting a FieldValue of type DocumentReference it exports the entire firebase ref as JSON. Included in that firebase ref is the service account private keys!

This is extremely dangerous - there must be some checks to make sure this can't happen. Here's a screenshot of the JSON I got back.

Possible Fix

Something I did and seemed to fix it is instead of these calls:

if (rawValue instanceof admin.firestore.Timestamp)
if (rawValue instanceof admin.firestore.GeoPoint)
if (rawValue instanceof admin.firestore.DocumentReference)

We could check the constructor - which wouldn't rely on using the exact same library, but rather any admin library as long as the types are the same name.

if (rawValue.constructor.name === 'Timestamp')
if (rawValue.constructor.name === 'GeoPoint')
if (rawValue.constructor.name === 'DocumentReference')