fix: add missing ownership checks in projects API (GHSA-rpf3-3973-4gjr)

[andifilhohub]

Summary

Fixes GHSA-rpf3-3973-4gjr — authenticated users could reassign flows they don't own into their project, exfiltrate the flow data via paginated API, and cause the victim to lose access to their flow.

Root cause — two missing ownership checks in projects.py:

• POST /api/v1/projects/: flows_list and components_list were applied via UPDATE without verifying Flow.user_id == current_user.id, allowing any user to move another user's flow into their own project
• GET /api/v1/projects/{id}?page=&size=: the paginated code path fetched flows with no user_id filter, leaking flows belonging to other users

Fix: add Flow.user_id == current_user.id to both UPDATE statements in create_project and to the paginated SELECT in read_project.

Attack chain

1. Attacker creates a project with flows_list: [victim_flow_id]
2. Victim's flow is silently moved to attacker's project — victim loses access
3. Attacker calls GET /api/v1/projects/{attacker_project_id}?page=1&size=50 and receives the victim's full flow data

Test plan

• Victim creates a flow
• Attacker creates a project with flows_list: [victim_flow_id] → project must be created empty
• Victim's flow folder_id must remain unchanged
• GET /api/v1/projects/{attacker_project_id}?page=1&size=50 must return 0 flows

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6daf5059-b9ae-4b55-b387-5981c90a7c78

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/project-flow-ownership-check

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 52.01%. Comparing base (cde9f23) to head (4c9b83a).
⚠️ Report is 1 commits behind head on release-1.9.0.

Files with missing lines	Patch %	Lines
src/backend/base/langflow/api/v1/projects.py	0.00%	1 Missing ⚠️

❌ Your patch status has failed because the patch coverage (0.00%) is below the target coverage (40.00%). You can increase the patch coverage or adjust the target coverage.
❌ Your project status has failed because the head coverage (49.28%) is below the target coverage (60.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@                Coverage Diff                @@
##           release-1.9.0   #12462      +/-   ##
=================================================
+ Coverage          51.83%   52.01%   +0.17%     
=================================================
  Files               2007     2004       -3     
  Lines             181207   181815     +608     
  Branches           27099    28337    +1238     
=================================================
+ Hits               93931    94572     +641     
+ Misses             86226    86193      -33     
  Partials            1050     1050              

Flag	Coverage Δ
backend	55.68% <0.00%> (+0.02%)	⬆️
frontend	51.82% <ø> (+0.25%)	⬆️
lfx	49.28% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/backend/base/langflow/api/v1/projects.py	37.75% <0.00%> (ø)

... and 104 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	33.5% (37901/113131)	66.75% (5072/7598)	34.79% (891/2561)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
3688	0 💤	0 ❌	0 🔥	7m 38s ⏱️

[Cristhianzl]

Please add test in your PR.

TESTING

Coverage Requirements

• No tests included in this PR

This is a CRITICAL gap for a security fix. The PR description includes a test plan but no automated tests.

Required tests:

1. Test: attacker cannot steal victim's flow via create_project

   • User A creates a flow
   • User B creates a project with flows_list: [user_a_flow_id]
   • Assert: User A's flow folder_id is unchanged
   • Assert: User B's project contains 0 flows

2. Test: paginated read_project does not leak other users' flows

   • Setup: project with flows from two different users
   • Assert: GET /projects/{id}?page=1&size=50 returns only current user's flows

3. Test: attacker cannot steal victim's flow via update_project (for the finding above)

4. Test: download_file does not include other users' flows (for the finding above)

Result: FAIL — security fixes MUST have regression tests.

[Cristhianzl]

lgtm