Merge pull request from GHSA-j7vx-8mqj-cqp9

* Attempt at fixing information disclosure vulnerability.

* Add `#as_json` method and attrs serialization restriction for Application model

* [ci skip] Add documentation for serialization

Co-authored-by: Nikita Bulai <bulaj.nikita@gmail.com>

Author: stefansundin

CHANGELOG.md

@@ -5,6 +5,16 @@ upgrade guides.
 
 User-visible changes worth mentioning.
 
+## 5.2.5
+
+- [#1371] Backport: add `#as_json` method and attributes serialization restriction for Application model.
+  Fixes information disclosure vulnerability (CVE-2020-10187).
+  
+  **[IMPORTANT]** you need to re-implement `#as_json` method for Doorkeeper Application model
+  if you previously used `#to_json` serialization with custom options or attributes or rely on
+  JSON response from /oauth/applications.json or /oauth/authorized_applications.json. This change
+  is a breaking change which restricts serialized attributes to a very small set of columns.
+
 ## 5.2.4
 
 - [#1360] Increase `matching_token_for` batch lookup size to 10 000 and make it configurable.

app/controllers/doorkeeper/applications_controller.rb

@@ -19,7 +19,7 @@ def index
     def show
       respond_to do |format|
         format.html
-        format.json { render json: @application }
+        format.json { render json: @application, as_owner: true }
       end
     end
 
@@ -36,7 +36,7 @@ def create
 
         respond_to do |format|
           format.html { redirect_to oauth_application_url(@application) }
-          format.json { render json: @application }
+          format.json { render json: @application, as_owner: true }
         end
       else
         respond_to do |format|
@@ -58,7 +58,7 @@ def update
 
         respond_to do |format|
           format.html { redirect_to oauth_application_url(@application) }
-          format.json { render json: @application }
+          format.json { render json: @application, as_owner: true }
         end
       else
         respond_to do |format|

app/controllers/doorkeeper/authorized_applications_controller.rb

@@ -9,7 +9,7 @@ def index
 
       respond_to do |format|
         format.html
-        format.json { render json: @applications }
+        format.json { render json: @applications, current_resource_owner: current_resource_owner }
       end
     end
 

lib/doorkeeper/orm/active_record/application.rb

@@ -70,10 +70,27 @@ def plaintext_secret
       end
     end
 
-    def to_json(options = nil)
-      serializable_hash(except: :secret)
-        .merge(secret: plaintext_secret)
-        .to_json(options)
+    # Represents client as set of it's attributes in JSON format.
+    # This is the right way how we want to override ActiveRecord #to_json.
+    #
+    # Respects privacy settings and serializes minimum set of attributes
+    # for public/private clients and full set for authorized owners.
+    #
+    # @return [Hash] entity attributes for JSON
+    #
+    def as_json(options = {})
+      # if application belongs to some owner we need to check if it's the same as
+      # the one passed in the options or check if we render the client as an owner
+      if (respond_to?(:owner) && owner && owner == options[:current_resource_owner]) ||
+         options[:as_owner]
+        # Owners can see all the client attributes, fallback to ActiveModel serialization
+        super
+      else
+        # if application has no owner or it's owner doesn't match one from the options
+        # we render only minimum set of attributes that could be exposed to a public
+        only = extract_serializable_attributes(options)
+        super(options.merge(only: only))
+      end
     end
 
     private
@@ -98,5 +115,48 @@ def scopes_match_configured
     def enforce_scopes?
       Doorkeeper.configuration.enforce_configured_scopes?
     end
+
+    # Helper method to extract collection of serializable attribute names
+    # considering serialization options (like `only`, `except` and so on).
+    #
+    # @param options [Hash] serialization options
+    #
+    # @return [Array<String>]
+    #   collection of attributes to be serialized using #as_json
+    #
+    def extract_serializable_attributes(options = {})
+      opts = options.try(:dup) || {}
+      only = Array.wrap(opts[:only]).map(&:to_s)
+
+      only = if only.blank?
+               serializable_attributes
+             else
+               only & serializable_attributes
+             end
+
+      only -= Array.wrap(opts[:except]).map(&:to_s) if opts.key?(:except)
+      only.uniq
+    end
+
+    # We need to hook into this method to allow serializing plan-text secrets
+    # when secrets hashing enabled.
+    #
+    # @param key [String] attribute name
+    #
+    def read_attribute_for_serialization(key)
+      return super unless key.to_s == "secret"
+
+      plaintext_secret || secret
+    end
+
+    # Collection of attributes that could be serialized for public.
+    # Override this method if you need additional attributes to be serialized.
+    #
+    # @return [Array<String>] collection of serializable attributes
+    def serializable_attributes
+      attributes = %w[id name created_at]
+      attributes << "uid" unless confidential?
+      attributes
+    end
   end
 end

lib/doorkeeper/version.rb

@@ -9,7 +9,7 @@ module VERSION
     # Semantic versioning
     MAJOR = 5
     MINOR = 2
-    TINY = 4
+    TINY = 5
     PRE = nil
 
     # Full version number