Prevent IDOR Takeover of DocumentStores

packages/server/src/Interface.DocumentStore.ts

@@ -299,9 +299,14 @@ export class DocumentStoreDTO {
 
     static toEntity(body: any): DocumentStore {
         const docStore = new DocumentStore()
-        Object.assign(docStore, body)
+        // Explicit allowlist — never accept id or timestamps from client
+        docStore.name = body.name
+        docStore.description = body.description ?? null
         docStore.loaders = body.loaders ?? '[]'
         docStore.whereUsed = body.whereUsed ?? '[]'
+        docStore.vectorStoreConfig = body.vectorStoreConfig ?? null
+        docStore.embeddingConfig = body.embeddingConfig ?? null
+        docStore.recordManagerConfig = body.recordManagerConfig ?? null
         // when a new document store is created, it is empty and in sync
         docStore.status = DocumentStoreStatus.EMPTY_SYNC
         return docStore

packages/server/src/controllers/documentstore/index.ts

@@ -26,14 +26,15 @@ const createDocumentStore = async (req: Request, res: Response, next: NextFuncti
         }
 
         const body = req.body
-        body.workspaceId = req.user?.activeWorkspaceId
-        if (!body.workspaceId) {
+        const workspaceId = req.user?.activeWorkspaceId
+        if (!workspaceId) {
             throw new InternalFlowiseError(
                 StatusCodes.PRECONDITION_FAILED,
                 `Error: documentStoreController.createDocumentStore - workspaceId not provided!`
             )
         }
         const docStore = DocumentStoreDTO.toEntity(body)
+        docStore.workspaceId = workspaceId
         const apiResponse = await documentStoreService.createDocumentStore(docStore, orgId)
         return res.json(apiResponse)
     } catch (error) {
@@ -355,7 +356,14 @@ const updateDocumentStore = async (req: Request, res: Response, next: NextFuncti
         }
         const body = req.body
         const updateDocStore = new DocumentStore()
-        Object.assign(updateDocStore, body)
+        // Explicit allowlist — id/workspaceId/timestamps must not be overrideable by client
+        if (body.name !== undefined) updateDocStore.name = body.name
+        if (body.description !== undefined) updateDocStore.description = body.description
+        if (body.vectorStoreConfig !== undefined) updateDocStore.vectorStoreConfig = body.vectorStoreConfig
+        if (body.embeddingConfig !== undefined) updateDocStore.embeddingConfig = body.embeddingConfig
+        if (body.recordManagerConfig !== undefined) updateDocStore.recordManagerConfig = body.recordManagerConfig
+        if (body.loaders !== undefined) updateDocStore.loaders = body.loaders
+        if (body.whereUsed !== undefined) updateDocStore.whereUsed = body.whereUsed
         const apiResponse = await documentStoreService.updateDocumentStore(store, updateDocStore)
         return res.json(DocumentStoreDTO.fromEntity(apiResponse))
     } catch (error) {

packages/server/src/services/documentstore/index.ts

@@ -1776,6 +1776,7 @@ const upsertDocStore = async (
         const docStoreBody = typeof data.docStore === 'string' ? JSON.parse(data.docStore) : data.docStore
         const newDocumentStore = docStoreBody ?? { name: `Document Store ${Date.now().toString()}` }
         const docStore = DocumentStoreDTO.toEntity(newDocumentStore)
+        docStore.workspaceId = workspaceId // enforce trusted server-side value, never from user input
         const documentStore = appDataSource.getRepository(DocumentStore).create(docStore)
         const dbResponse = await appDataSource.getRepository(DocumentStore).save(documentStore)
         storeId = dbResponse.id