Data Exposure in Feathersjs with Dynamodb

Remediation focuses on controlling which attributes are returned and ensuring that every query respects user permissions. In FeathersJS, this involves customizing service logic and hooks to filter fields and validate ownership of records before returning data.

1. Explicit field selection using projection expressions

When querying Dynamodb, use projection expressions to return only required attributes. This reduces the risk of exposing sensitive fields such as internalNotes, ssn, or passwordHash. Below is an example of a custom FeathersJS hook that modifies the query to include a projection expression.

// src/hooks/select-fields.hooks.js
module.exports = function selectFields(allowedFields) {
  return async context => {
    const { params } = context;
    if (params.query) {
      const { $select, ...query } = params.query;
      const projectionExpression = allowedFields.join(',');
      params.body = params.body || {};
      params.body.ProjectionExpression = projectionExpression;
      // Preserve non-attribute query parameters
      params.query = query;
    }
    return context;
  };
};

// Usage in a FeathersJS service
const selectPublicFields = selectFields(['userId', 'email', 'profileName']);
service.hooks.push(selectPublicFields);

2. Record-level ownership checks in before hooks

Ensure that users can only access records they own by adding a before hook that enforces row-level security. This example assumes the user ID is available in params.user.sub.

// src/hooks/ownership-check.hooks.js
module.exports = function ownershipCheck() {
  return async context => {
    const { user } = context.params;
    if (user && user.sub) {
      context.params.query = context.params.query || {};
      // For get requests, validate owner ID matches
      if (context.id) {
        context.params.query.ownerId = user.sub;
      } else if (context.params.query) {
        context.params.query.FilterExpression = '(ownerId = :uid) AND ' +
          (context.params.query.FilterExpression || 'attribute_exists(id)');
        context.params.query.ExpressionAttributeValues = {
          ':uid': user.sub,
          ...context.params.query.ExpressionAttributeValues
        };
      }
    }
    return context;
  };
};

3. Avoid returning sensitive fields in get responses

Customize the get method to exclude internal attributes by transforming the result before sending it to the client. This is particularly important when using Dynamodb document clients that return entire items.

// src/services/secure-data.service.js
const { Service } = require('feathersjs');
const dynamodb = require('aws-sdk/clients/dynamodb');
const docClient = new dynamodb.DocumentClient();

class SecureDataService extends Service {
  async get(id, params) {
    const result = await docClient.get({
      TableName: process.env.DYNAMODB_TABLE,
      Key: { id }
    }).promise();

    const item = result.Item;
    if (!item) {
      throw new Error('Not found');
    }

    // Explicitly return only safe fields
    return {
      id: item.id,
      email: item.email,
      displayName: item.displayName,
      createdAt: item.createdAt
    };
  }
}

module.exports = function init() {
  const app = this;
  app.use('/secure-data', new SecureDataService());
};

4. Limit use of Scan operations and enforce filtering

Prefer query operations over Scan to avoid full table reads. If Scan is necessary, apply strict filter expressions and projection expressions to limit returned data.

// src/hooks/limit-scan.hooks.js
module.exports = function limitScan() {
  return async context => {
    const query = context.params.query || {};
    if (query.$scan) {
      context.params.body = context.params.body || {};
      context.params.body.FilterExpression = query.filterExpression || 'attribute_exists(id)';
      context.params.body.ProjectionExpression = query.projectionExpression || 'id,email';
      delete context.params.query.$scan;
    }
    return context;
  };
};

5. Validate and sanitize index usage

If using GSIs, ensure that the index projections do not include sensitive attributes. When querying a GSI, map only required fields and avoid relying on index keys that may expose internal state.

// Example GSI query with restricted projection
const queryParams = {
  TableName: 'UsersTable',
  IndexName: 'EmailIndex',
  KeyConditionExpression: 'email = :emailVal',
  ExpressionAttributeValues: { ':emailVal': '[email protected]' },
  ProjectionExpression: 'id,email,displayName'
};

await docClient.query(queryParams).promise();

These patterns help ensure that data exposure through Dynamodb in FeathersJS services is minimized. By combining field-level selection, ownership enforcement, and careful query design, teams can reduce the likelihood of sensitive data being returned unintentionally.