Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment

[christopherholland-workday]

Flowise-303

[gemini-code-assist]

Code Review

This pull request effectively addresses a critical mass assignment vulnerability in the assistant update endpoint. By replacing Object.assign and merge with an explicit allowlist of updatable fields, it prevents unauthorized modifications to sensitive properties like workspaceId, mitigating cross-workspace resource reassignment. However, the credential field still lacks ownership verification, which could lead to IDOR, and the iconSrc field requires validation to prevent stored XSS. Furthermore, the validation for the details field could be enhanced to explicitly handle null parsing.

[gemini-code-assist]

The current validation could be more precise. If requestBody.details is the string "null", it will be parsed into a null value. For a 'CUSTOM' assistant, this would incorrectly trigger the "Details must include a name field" error because !null?.name evaluates to true. It would be better to explicitly check for null after parsing to provide a more accurate error message. This also allows for safer property access on parsedDetails in the subsequent check.

Suggested change

	if (assistant.type === 'CUSTOM' && !parsedDetails?.name) {
	throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Details must include a name field`)
	}
	if (parsedDetails === null) {
	throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Details JSON cannot be null`)
	}
	if (assistant.type === 'CUSTOM' && !parsedDetails.name) {
	throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Details must include a name field`)
	}