Exclude git provider secrets at query level in findApplicationById
refactor(security): exclude git provider secrets at query level in findApplicationById
Exclude git provider secrets at query level in findApplicationByIdecbaf6-refactor-exclude-git-provider-secrets-at-query-cve-2026-86059refactorexclude git provider secrets query level
Committed by Siumauricio
commit message
refactor(security): exclude git provider secrets at query level in findApplicationById
Simpler and consistent with the existing registry column exclusion in the same
query: drop the secret columns from the nested github/gitlab/gitea/bitbucket
relations via columns:{ ...: false } instead of a post-fetch redaction helper.
Server-side clone paths re-fetch providers by id (find{Github,Gitlab,...}ById),
so deployments are unaffected. Column names are validated at compile time by
drizzle's typed columns config.
Closes GHSA-hg9j-j5mc-phf5, GHSA-wx75-vxph-2m2fEditor assessment
This commit patches CVE-2026-86059. Precise and self-sufficient. The full subject says exactly where the change lands (query level in findApplicationById), and the body explains the technique: drop secret columns from the nested provider relations via typed column config instead of a post-fetch redaction helper. It also addresses the obvious concern - server-side clone paths re-fetch by id, so deployments are unaffected - and notes compile-time validation. Clean, accurate and easy to review. Style-wise the header is a clean refactor with an accurate security scope and the body is separated and readable; there is nothing formal left to fix.