getgrav/grav-plugin-api: API plugin: anonymous translation requests grow the cache without limit, and translation sync and batch copy skip page rules

Summary

The public GET /api/v1/translations/{lang} endpoint of the Grav API plugin cached a full copy of the translation dictionary for seven days for every well-formed language code it was sent, whether or not any language file exists for that code. An unauthenticated visitor could grow the site's cache without limit, filling the disk on hosts that use the file cache or constantly evicting APCu.

Separately, POST /api/v1/pages/{route}/sync checked the page rules of the source translation but wrote the target, and POST /api/v1/pages/batch with copy did not check the destination's create rule. An account with api.pages.write could therefore get past page-level permission rules the site had set against it.

Affected versions

grav-plugin-api 1.0.40 and 1.0.41 for the translations cache. 1.0.16 through 1.0.41 for the sync and batch copy checks.

Details

Language codes that no core, plugin, theme or site file ships now resolve to the site default, and prefixed requests are filtered from the cached full dictionary instead of being stored under their own key. Sync now requires update on the target translation, and batch copy applies the destination's create rule, as single-page copy, move and reorganize already did.

On this install each crafted request of under 100 bytes stored a cache entry of about 560 KB.

The report also noted that GET /pages/{route}/compare returns the source of a page whose Twig content the caller may not edit. Reading page source is within api.pages.read, so that is not part of this advisory, but compare now applies the same check as opening the page.

Impact

Any visitor, with no account, can exhaust disk or cache and take the site down. Accounts with api.pages.write can overwrite a translation, or create pages under a section, that page-level rules deny them.

Patches

Fixed in grav-plugin-api 1.0.42.

Credits

Reported by @ma4ter.