Skip to content

[PM-34134] [Innovation] Implement UserPreferences table and add to sync response#7329

Merged
gbubemismith merged 19 commits intoinnovation/sync-user-preferencesfrom
innovation/sync-user-preferences-PM-34134
Apr 1, 2026
Merged

[PM-34134] [Innovation] Implement UserPreferences table and add to sync response#7329
gbubemismith merged 19 commits intoinnovation/sync-user-preferencesfrom
innovation/sync-user-preferences-PM-34134

Conversation

@gbubemismith
Copy link
Copy Markdown
Contributor

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-34134

📔 Objective

📸 Screenshots

@gbubemismith gbubemismith requested review from a team as code owners March 27, 2026 18:12
@gbubemismith gbubemismith requested review from nick-livefront and shane-melton and removed request for a team March 27, 2026 18:12
@gbubemismith gbubemismith changed the title [PM-34134] Implement UserPreferences table and add to sync response [PM-34134] [Innovation] Implement UserPreferences table and add to sync response Mar 27, 2026
@gbubemismith gbubemismith removed the request for review from nick-livefront March 27, 2026 18:13
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 27, 2026

Codecov Report

❌ Patch coverage is 96.15385% with 6 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (innovation/sync-user-preferences@624206d). Learn more about missing BASE report.

Files with missing lines Patch % Lines
...Api/Vault/Controllers/UserPreferencesController.cs 83.33% 0 Missing and 4 partials ⚠️
src/Api/Vault/Controllers/SyncController.cs 85.71% 0 Missing and 1 partial ⚠️
...re.EntityFramework/Vault/Models/UserPreferences.cs 80.00% 1 Missing ⚠️
Additional details and impacted files
@@                         Coverage Diff                         @@
##             innovation/sync-user-preferences    #7329   +/-   ##
===================================================================
  Coverage                                    ?   62.15%           
===================================================================
  Files                                       ?     2059           
  Lines                                       ?    90582           
  Branches                                    ?     8053           
===================================================================
  Hits                                        ?    56304           
  Misses                                      ?    32322           
  Partials                                    ?     1956           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 27, 2026

Logo
Checkmarx One – Scan Summary & Details23fadfdd-cb6d-4f6b-838c-8a30f1a4b09c


New Issues (140) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL Stored_XSS /src/SharedWeb/Health/HealthCheckServiceExtensions.cs: 61
detailsThe method embeds untrusted data in generated output with WriteAsync, at line 60 of /src/SharedWeb/Health/HealthCheckServiceExtensions.cs. This ...
Attack Vector
2 CRITICAL Stored_XSS /util/Server/Startup.cs: 57
detailsThe method embeds untrusted data in generated output with WriteAsync, at line 59 of /util/Server/Startup.cs. This untrusted data is embedded int...
Attack Vector
3 HIGH CVE-2022-37620 Npm-html-minifier-4.0.0
detailsDescription: A Regular Expression Denial of Service (ReDoS) flaw was found in html-minifier versions 2.1.0 through 4.0.0 via the "candidate" variable in "htmlmi...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
4 HIGH CVE-2025-64756 Npm-glob-10.4.5
detailsRecommended version: 10.5.0
Description: Glob matches files using patterns the shell uses. In versions 10.2.0 prior to 10.5.0 and 11.0.0 prior to 11.1.0, the glob CLI contains a command in...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
5 HIGH CVE-2026-26996 Npm-minimatch-9.0.5
detailsRecommended version: 9.0.7
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions prior to 3.1.3, 4.0.0 prior to 4.2...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
6 HIGH CVE-2026-26996 Npm-minimatch-3.1.2
detailsRecommended version: 3.1.4
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions prior to 3.1.3, 4.0.0 prior to 4.2...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
7 HIGH CVE-2026-26996 Npm-minimatch-9.0.1
detailsRecommended version: 9.0.7
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions prior to 3.1.3, 4.0.0 prior to 4.2...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
8 HIGH CVE-2026-27903 Npm-minimatch-9.0.1
detailsRecommended version: 9.0.7
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
9 HIGH CVE-2026-27903 Npm-minimatch-3.1.2
detailsRecommended version: 3.1.4
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
10 HIGH CVE-2026-27903 Npm-minimatch-9.0.5
detailsRecommended version: 9.0.7
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
11 HIGH CVE-2026-27904 Npm-minimatch-9.0.5
detailsRecommended version: 9.0.7
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
12 HIGH CVE-2026-27904 Npm-minimatch-3.1.2
detailsRecommended version: 3.1.4
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
13 HIGH CVE-2026-27904 Npm-minimatch-9.0.1
detailsRecommended version: 9.0.7
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
14 HIGH CVE-2026-29063 Npm-immutable-5.1.3
detailsRecommended version: 5.1.5
Description: Immutable.js provides many Persistent Immutable data structures. 3.x prior to versions 3.8.3, 4.x prior to versions 4.3.7, and 5.x prior to versio...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
15 HIGH CVE-2026-32933 Nuget-AutoMapper-12.0.1
detailsRecommended version: 15.1.1
Description: AutoMapper is vulnerable to a Denial-of-Service (DoS) attack. Versions prior to 15.1.1 and 16.x prior to 16.1.1, when mapping deeply nested object ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
16 HIGH CVE-2026-33671 Npm-picomatch-2.3.1
detailsRecommended version: 2.3.2
Description: `picomatch` is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
17 HIGH Cxf5fb15b0-6576 Npm-serialize-javascript-6.0.2
detailsRecommended version: 7.0.3
Description: serialize-javascript through 7.0.2 contains a code injection vulnerability due to improper escaping of "RegExp.flags" during serialization. Althoug...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
18 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 55
detailsMethod at line 55 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This pa...
Attack Vector
19 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
detailsMethod at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from request. T...
Attack Vector
20 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
detailsMethod at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from request. T...
Attack Vector
21 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
detailsMethod at line 97 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. This...
Attack Vector
22 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
detailsMethod at line 97 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. This...
Attack Vector
23 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 229
detailsMethod at line 229 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
24 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1562
detailsMethod at line 1562 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
25 MEDIUM CSRF /src/Api/Tools/Controllers/SendsController.cs: 73
detailsMethod at line 73 of /src/Api/Tools/Controllers/SendsController.cs gets a parameter from a user request from id. This parameter value flows thro...
Attack Vector
26 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 145
detailsMethod at line 145 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This p...
Attack Vector
27 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 217
detailsMethod at line 217 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
28 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
29 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
30 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
31 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
32 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
33 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
34 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
35 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
36 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 173
detailsMethod at line 173 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
37 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 452
detailsMethod at line 452 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
38 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 189
detailsMethod at line 189 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
39 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 522
detailsMethod at line 522 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
40 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 104
detailsMethod at line 104 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This p...
Attack Vector
41 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 107
detailsMethod at line 107 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organiza...
Attack Vector
42 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1421
detailsMethod at line 1421 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
43 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 233
detailsMethod at line 233 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
44 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 286
detailsMethod at line 286 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
45 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 189
detailsMethod at line 189 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
46 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1421
detailsMethod at line 1421 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
47 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1421
detailsMethod at line 1421 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
48 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 289
detailsMethod at line 289 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from orgUserId. This parameter ...
Attack Vector
49 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1389
detailsMethod at line 1389 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
50 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1450
detailsMethod at line 1450 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
51 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1152
detailsMethod at line 1152 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
52 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1034
detailsMethod at line 1034 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
53 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1285
detailsMethod at line 1285 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from organizationId. This parameter ...
Attack Vector
54 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 390
detailsMethod at line 390 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
55 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 381
detailsMethod at line 381 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
56 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 381
detailsMethod at line 381 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from id. This parame...
Attack Vector
57 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 95
detailsMethod at line 95 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organizat...
Attack Vector
58 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs: 82
detailsMethod at line 82 of /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs gets a parameter from a user request from provider. Th...
Attack Vector
59 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 93
detailsMethod at line 93 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This pa...
Attack Vector
60 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 49
detailsMethod at line 49 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organizat...
Attack Vector
61 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs: 40
detailsMethod at line 40 of /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs gets a parameter from a user request from provider. Th...
Attack Vector
62 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1230
detailsMethod at line 1230 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flo...
Attack Vector
63 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 173
detailsMethod at line 173 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
64 MEDIUM CSRF /src/Api/Vault/Controllers/SecurityTaskController.cs: 66
detailsMethod at line 66 of /src/Api/Vault/Controllers/SecurityTaskController.cs gets a parameter from a user request from taskId. This parameter value...
Attack Vector
65 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 721
detailsMethod at line 721 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from request. This parameter value fl...
Attack Vector
66 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 192
detailsMethod at line 192 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
67 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 641
detailsMethod at line 641 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
68 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 664
detailsMethod at line 664 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
69 MEDIUM CSRF /src/Api/Auth/Controllers/EmergencyAccessController.cs: 173
detailsMethod at line 173 of /src/Api/Auth/Controllers/EmergencyAccessController.cs gets a parameter from a user request from model. This parameter val...
Attack Vector
70 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 385
detailsMethod at line 385 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
71 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 412
detailsMethod at line 412 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
72 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 126
detailsMethod at line 126 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
73 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
74 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
75 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
76 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
77 MEDIUM CSRF /src/Api/NotificationCenter/Controllers/NotificationsController.cs: 61
detailsMethod at line 61 of /src/Api/NotificationCenter/Controllers/NotificationsController.cs gets a parameter from a user request from id. This param...
Attack Vector
78 MEDIUM CSRF /src/Api/NotificationCenter/Controllers/NotificationsController.cs: 67
detailsMethod at line 67 of /src/Api/NotificationCenter/Controllers/NotificationsController.cs gets a parameter from a user request from id. This param...
Attack Vector
79 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1450
detailsMethod at line 1450 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
80 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 763
detailsMethod at line 763 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector

More results are available on the CxOne platform

@gbubemismith gbubemismith added ai-review Request a Claude code review labels Mar 27, 2026
@claude
Copy link
Copy Markdown
Contributor

claude bot commented Mar 27, 2026

Claude encountered an error —— View job


I'll analyze this and get back to you.

userAccountKeys = await _userAccountKeysQuery.Run(user);
}

var userPreferences = await _userPreferencesRepository.GetByUserIdAsync(user.Id);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ IMPORTANT: UserPreferences query runs on every sync call regardless of feature flag state

Details and fix

The UserPreferencesController is gated behind [RequireFeature(FeatureFlagKeys.SyncUserPreferences)], but this sync endpoint unconditionally queries the UserPreferences table for every user on every sync call. This adds an extra DB round-trip to one of the most frequently called endpoints, even when the feature is disabled and no users have preferences.

This controller already establishes the pattern of gating behind feature flags before querying -- see webAuthnCredentials on line 131:

var webAuthnCredentials = _featureService.IsEnabled(FeatureFlagKeys.PM2035PasskeyUnlock)
    ? await _webAuthnCredentialRepository.GetManyByUserIdAsync(user.Id)
    : [];

Suggested fix:

Suggested change
var userPreferences = await _userPreferencesRepository.GetByUserIdAsync(user.Id);
var userPreferences = _featureService.IsEnabled(FeatureFlagKeys.SyncUserPreferences)
? await _userPreferencesRepository.GetByUserIdAsync(user.Id)
: null;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gbubemismith We should probably gate the query behind the flag in the sync controller as suggested.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh I missed this

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed c91a597

@gbubemismith gbubemismith marked this pull request as draft March 30, 2026 18:16
@gbubemismith gbubemismith marked this pull request as ready for review March 30, 2026 18:22
Copy link
Copy Markdown
Member

@shane-melton shane-melton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great! Only suggestion would be to feature flag the sync controller, but since this is going to a feature branch first anyways, doesn't need to hold it up.

@sonarqubecloud
Copy link
Copy Markdown

@gbubemismith gbubemismith merged commit 1921a7e into innovation/sync-user-preferences Apr 1, 2026
50 of 51 checks passed
@gbubemismith gbubemismith deleted the innovation/sync-user-preferences-PM-34134 branch April 1, 2026 17:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai-review Request a Claude code review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants