Fix Security Misconfiguration in Meteor

// Default state with 'insecure' and 'autopublish' packages installed
Messages = new Mongo.Collection('messages');
if (Meteor.isClient) {
// VULNERABILITY: With ‘insecure’ enabled, any user can execute DB commands from the browser console
// Attacker can run: Messages.remove({}); or inject malicious payloads
Messages.insert({ text: ‘Attacker payload’, isAdmin: true });
}
// VULNERABILITY: With ‘autopublish’ enabled, the entire DB is synced to the client
// Sensitive fields (hashed passwords, emails, internal IDs) are visible in Minimongo

// 1. Run in terminal: meteor remove insecure autopublish
Messages = new Mongo.Collection(‘messages’);
if (Meteor.isServer) {
// SECURE: Explicitly publish only necessary data and filter sensitive fields
Meteor.publish(‘messages’, function() {
if (!this.userId) return this.ready();
return Messages.find({ owner: this.userId }, {
fields: { secretMetadata: 0 }
});
});
// SECURE: Use Methods for writes. Validate everything.
Meteor.methods({
‘messages.insert’(text) {
check(text, String); // Enforce schema
if (!this.userId) {
throw new Meteor.Error(‘not-authorized’, ‘Must be logged in to post.’);
}
Messages.insert({
text,
owner: this.userId,
createdAt: new Date()
});
}
});
}
if (Meteor.isClient) {
// SECURE: Subscribe to specific records
Meteor.subscribe(‘messages’);
}