Security advisory GHSA-6jqm-3c9g-pch7: @cubejs-backend/api-gateway row level security bypass
Package: @cubejs-backend/api-gateway (npm), vulnerable version: 0.31.23, fixed in: 0.31.24
CWE: CWE-89
Files changed by the fix:
packages/cubejs-api-gateway/src/gateway.ts
packages/cubejs-server-core/src/core/CompilerApi.js

Fix diff:
diff --git a/packages/cubejs-api-gateway/src/gateway.ts b/packages/cubejs-api-gateway/src/gateway.ts
index 56caf82fda32b..498d333eafd05 100644
--- a/packages/cubejs-api-gateway/src/gateway.ts
+++ b/packages/cubejs-api-gateway/src/gateway.ts
@@ -448,7 +448,7 @@ class ApiGateway {
       const metaConfigExtended = await this.getCompilerApi(context).metaConfigExtended({
         requestId: context.requestId,
       });
-      const { metaConfig, cubeDefinitions, dataSources } = metaConfigExtended;
+      const { metaConfig, cubeDefinitions } = metaConfigExtended;
 
       const cubes = this.filterVisibleItemsInMeta(context, metaConfig)
         .map((meta) => meta.config)
@@ -466,7 +466,7 @@ class ApiGateway {
           joins: transformJoins(cubeDefinitions[cube.name]?.joins),
           preAggregations: transformPreAggregations(cubeDefinitions[cube.name]?.preAggregations),
         }));
-      res({ cubes, dataSources });
+      res({ cubes });
     } catch (e) {
       this.handleError({
         e,
diff --git a/packages/cubejs-server-core/src/core/CompilerApi.js b/packages/cubejs-server-core/src/core/CompilerApi.js
index 3dc47e3b23558..63069b13aa5f9 100644
--- a/packages/cubejs-server-core/src/core/CompilerApi.js
+++ b/packages/cubejs-server-core/src/core/CompilerApi.js
@@ -66,10 +66,6 @@ export class CompilerApi {
     return this.compilers;
   }
 
-  async getDataSources(cubeEvaluator) {
-    return Promise.all(cubeEvaluator.cubeNames().map(async cube => cubeEvaluator.cubeFromPath(cube).dataSource ?? 'default'));
-  }
-
   async createQueryFactory(compilers) {
     const { cubeEvaluator } = compilers;
 
@@ -184,10 +180,9 @@ export class CompilerApi {
   }
 
   async metaConfigExtended(options) {
-    const { metaTransformer, cubeEvaluator } = await this.getCompilers(options);
+    const { metaTransformer } = await this.getCompilers(options);
     return {
       metaConfig: metaTransformer?.cubes,
-      dataSources: await this.getDataSources(cubeEvaluator),
       cubeDefinitions: metaTransformer?.cubeEvaluator?.cubeDefinitions,
     };
   }
diff --git a/packages/cubejs-server-core/test/unit/index.test.ts b/packages/cubejs-server-core/test/unit/index.test.ts
index 7f803d76a4a3a..7b49cdb52f3b2 100644
--- a/packages/cubejs-server-core/test/unit/index.test.ts
+++ b/packages/cubejs-server-core/test/unit/index.test.ts
@@ -52,34 +52,6 @@ cube('Bar', {
   ]),
 };
 
-const repositoryWithDataSource: SchemaFileRepository = {
-  localPath: () => __dirname,
-  dataSchemaFiles: () => Promise.resolve([
-    {
-      fileName: 'main.js', content: `
-cube('Bar', {
-  sql: 'select * from bar',
-  
-  measures: {
-    count: {
-      type: 'count'
-    }
-  },
-
-  dataSource: 'dataSource',
-
-  dimensions: {
-    time: {
-      sql: 'timestamp',
-      type: 'time'
-    }
-  }
-});
-`,
-    },
-  ]),
-};
-
 const repositoryWithoutContent: SchemaFileRepository = {
   localPath: () => __dirname,
   dataSchemaFiles: () => Promise.resolve([{ fileName: 'main.js', content: '' }]),
@@ -363,29 +335,6 @@ describe('index.test', () => {
       expect(metaConfigExtended).toHaveProperty('metaConfig');
       expect(metaConfigExtended.metaConfig.length).toBeGreaterThan(0);
       expect(metaConfigExtended).toHaveProperty('cubeDefinitions');
-      expect(metaConfigExtended).toHaveProperty('dataSources');
-      expect(metaConfigExtended.dataSources).toEqual(['default']);
-      expect(metaConfigExtendedSpy).toHaveBeenCalled();
-      metaConfigExtendedSpy.mockClear();
-    });
-  });
-  
-  describe('CompilerApi with dataSource', () => {
-    const logger = jest.fn(() => {});
-    const compilerApi = new CompilerApi(
-      repositoryWithDataSource,
-      async () => 'mysql',
-      { logger }
-    );
-    const metaConfigExtendedSpy = jest.spyOn(compilerApi, 'metaConfigExtended');
-
-    test('CompilerApi metaConfigExtended', async () => {
-      const metaConfigExtended = await compilerApi.metaConfigExtended({ requestId: 'XXX' });
-      expect(metaConfigExtended).toHaveProperty('metaConfig');
-      expect(metaConfigExtended.metaConfig.length).toBeGreaterThan(0);
-      expect(metaConfigExtended).toHaveProperty('cubeDefinitions');
-      expect(metaConfigExtended).toHaveProperty('dataSources');
-      expect(metaConfigExtended.dataSources).toEqual(['dataSource']);
       expect(metaConfigExtendedSpy).toHaveBeenCalled();
       metaConfigExtendedSpy.mockClear();
     });