846693 - Phonebook :: API :: The result list of API request, lists the email account in public.

Status: VERIFIED INVALID

(Participation Infrastructure :: Phonebook, defect)

Description

[ravi]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0
Build ID: 20130116232420

Steps to reproduce:


Obsrevations:

Hitting a request from present API protocol on staging server, could see the personal identification details in public.  If the same will be used in production server/environment and one who is aware of this API handling and technical details, it could be misused.



Actual results:



Sample of API response showing the persona identifty information:
------------------------------------------------------------------


{"meta": {"limit": 80, "next": null, "offset": 0, "previous": null, "total_count": 9}, "objects": [{"email": "[e-mail]", "is_vouched": true}, {"email": "", "is_vouched": false}, {"allows_community_sites": true, "allows_mozilla_sites": true, "basket_token": "", "bio": "", "city": "", "country": "", "email": "[e-mail]", "full_name": "Ankur Jain", "groups": [], "id": "4008", "ircname": "", "is_vouched": false, "languages": [], "last_updated": "2013-03-01T01:51:29", "photo": "http://www.gravatar.com/avatar/4a20880ef2c288a6c3e26a3958037491?s=175&r=pg&d=https%3A%2F%2Fmozillians.allizom.org%2Fmedia%2Fimg%2Funknown.png", "region": "", "resource_uri": "/api/v1/users/4008/", "skills": [], "website": ""}, {"allows_community_sites": true, "allows_mozilla_sites": true, "basket_token": "", "bio": "", "city": "", "country": "", "email": "", "full_name": "", "groups": [], "id": "4058", "ircname": "", "is_vouched": false, "languages": [], "last_updated": "2013-03-01T02:03:19", "photo": "http://www.gravatar.com/avatar/d41d8cd98f00b204e9800998ecf8427e?s=175&r=pg&d=https%3A%2F%2Fmozillians.allizom.org%2Fmedia%2Fimg%2Funknown.png", "region": "", "resource_uri": "/api/v1/users/4058/", "skills": [], "website": ""}, {"allows_community_sites": true, "allows_mozilla_sites": true, "basket_token": "", "bio": "", "city": "", "country": "in", "email": "[e-mail]", "full_name": "Vanishree", "groups": [], "id": "4059", "ircname": "", "is_vouched": false, "languages": [], "last_updated": "2013-03-01T01:45:57", "photo": "http://www.gravatar.com/avatar/0f4cb42d411dd4a0d69b275b76bffbcc?s=175&r=pg&d=https%3A%2F%2Fmozillians.allizom.org%2Fmedia%2Fimg%2Funknown.png", "region": "", "resource_uri": "/api/v1/users/4059/", "skills": [], "website": ""}, {"allows_community_sites": true, "allows_mozilla_sites": true, "basket_token": "8e29e8f9-971e-4297-805a-50b18b88bc5e", "bio": "CREATOR", "city": "Bangalore", "country": "in", "email": "[e-mail]", "full_name": "Nagasahas", "groups": ["security", "web development"], "id": "3676", "ircname": "sas", "is_vouched": true, "languages": ["english"], "last_updated": "2013-02-27T04:09:41", "photo": "http://www.gravatar.com/avatar/bacfe76c85d8b3efc8ae66c4e505e858?s=175&r=pg&d=https%3A%2F%2Fmozillians.allizom.org%2Fmedia%2Fimg%2Funknown.png", "region": "karnataka", "resource_uri": "/api/v1/users/3676/", "skills": ["java", "java script"], "website": ""}, {"allows_community_sites": true, "allows_mozilla_sites": true, "basket_token": "", "bio": "", "city": "", "country": "", "email": "[e-mail]", "full_name": "Ankur Jain", "groups": [], "id": "4055", "ircname": "", "is_vouched": false, "languages": [], "last_updated": "2013-03-01T01:59:50", "photo": "/media/uploads/userprofile/3c4f1b09-3172-4fed-a637-ac66fcc8ab98.jpg", "region": "", "resource_uri": "/api/v1/users/4055/", "skills": [], "website": ""}, {"allows_community_sites": true, "allows_mozilla_sites": true, "basket_token": "81ce3713-a9e2-41ea-bda8-1a898641941b", "bio": "", "city": "", "country": "in", "email": "[e-mail]", "full_name": "kumar falke", "groups": ["web development", "qa"], "id": "4049", "ircname": "gfffg", "is_vouched": true, "languages": [], "last_updated": "2013-03-01T01:18:05", "photo": "http://www.gravatar.com/avatar/98bcbf2b72fddf6c6b1fac35eea4b6fc?s=175&r=pg&d=https%3A%2F%2Fmozillians.allizom.org%2Fmedia%2Fimg%2Funknown.png", "region": "", "resource_uri": "/api/v1/users/4049/", "skills": [], "website": ""}, {"allows_community_sites": true, "allows_mozilla_sites": true, "basket_token": "", "bio": "", "city": "", "country": "", "email": "[e-mail]", "full_name": "awalahalli", "groups": ["web development", "ugly tuna", "no beard"], "id": "4056", "ircname": "", "is_vouched": false, "languages": [], "last_updated": "2013-02-28T23:34:36", "photo": "http://www.gravatar.com/avatar/2637ae6527a14534748ce6ee58c5970c?s=175&r=pg&d=https%3A%2F%2Fmozillians.allizom.org%2Fmedia%2Fimg%2Funknown.png", "region": "", "resource_uri": "/api/v1/users/4056/", "skills": [], "website": ""}]}





Expected results:


Purpose of the report:
---------------------

1. To intimate about the problem that can come up if the same is moved on to production server without protection on API calls being made.

Comment 1

[ravi]

In past experience of the tester, he has noticed the API's and web services being open and accessible to public in production server.  And this nature of being open, was critical to business and brand of the product and vendor.  

It can happen a person who worked to build this API and web services on moving out of an organization could use it. On using, the details could be fetched. I observe even Mozilla employees detail can come under this Phonebook.  With this critical sensitivity, tester wish to report the potential problem that can come up if it is not handled well enough to the context.

Comment 2

[Giorgos Logiotatidis [:giorgos]]

Ravi,

Can you give me the API URL you used to get the data? 

Thanks!

Comment 3

[ravi]

Hi Giorgos,

Below is the URL used for looking at this detail:

https://mozillians.allizom.org/api/v1/users/?app_name=mozapp&app_key=test


Let me know if any more information needed.
Thanks!

Comment 4

[Giorgos Logiotatidis [:giorgos]]

OK so you're using an app_name and an app_key to access the full details of profiles using the API. That means that the information is not public, you can't get it without supplying app_name and app_key. We don't use the same API keys in production.

Maybe I don't understand the problem, but does the paragrash above answer your concerns?

Thanks for reporting!

Comment 5

[ravi]

OK, will test once it is in production.  The first para written answers the concern.

Thanks!

Comment 6

[Giorgos Logiotatidis [:giorgos]]

This is in production. What we don't have in production is the demo keys, and we're not going too ;)

Comment 7

[Giorgos Logiotatidis [:giorgos]]

Marking invalid as per comment 4

Comment 8

[Matt Brandt [:mbrandt]]

QA verified invalid - the key that we use for API testing are not on production.

Thank you for filing the bug ravi :)