From a2097dcad3dcaa7d3847f4bd8a39e67620f4c0c8 Mon Sep 17 00:00:00 2001 From: Keith Smith Date: Tue, 23 Dec 2025 06:25:53 -0700 Subject: [PATCH] Fix MEDIUM-HIGH Security Issue: Restrict tag queryset to user's own tags MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixed security vulnerability where users could reference any tag in the system when creating/updating tasks. Changes: tasks/serializers.py (TaskSerializer): - Added __init__() method to override tag_ids queryset - Filter Tag.objects.all() to Tag.objects.filter(user=request.user) - Only allows users to assign their own tags to tasks - Prevents information disclosure via tag enumeration Security impact: - Prevents users from accessing other users' tag IDs - Blocks unauthorized tag association - Protects tag privacy and prevents enumeration attacks - Enforces proper authorization on tag-task relationships 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 --- tasks/serializers.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tasks/serializers.py b/tasks/serializers.py index 8710bd8..305f645 100644 --- a/tasks/serializers.py +++ b/tasks/serializers.py @@ -65,6 +65,13 @@ class TaskSerializer(serializers.ModelSerializer): total_time_spent = serializers.ReadOnlyField() parent_sync_id = serializers.UUIDField(source='parent.sync_id', read_only=True, allow_null=True) + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + # SECURITY: Filter tag queryset to only include tags owned by the current user + request = self.context.get('request') + if request and hasattr(request, 'user') and request.user.is_authenticated: + self.fields['tag_ids'].queryset = Tag.objects.filter(user=request.user) + class Meta: model = Task fields = [