From 2c91b89f021c742be54b6ed32cda6c8d0a2f37ad Mon Sep 17 00:00:00 2001
From: Andrew Kingston <aptkingston@ssl-mail.com>
Date: Tue, 30 Nov 2021 14:32:18 +0000
Subject: [PATCH] Prevent data providers from using arbitrary context-providing
 components as sources

---
 .../builder/src/builderStore/dataBinding.js   |  4 ++--
 .../PropertyControls/DataSourceSelect.svelte  | 21 +++++++++++--------
 .../EventsEditor/actions/SaveRow.svelte       |  4 ++--
 3 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/packages/builder/src/builderStore/dataBinding.js b/packages/builder/src/builderStore/dataBinding.js
index 9a41ad2afc..cb09b33970 100644
--- a/packages/builder/src/builderStore/dataBinding.js
+++ b/packages/builder/src/builderStore/dataBinding.js
@@ -61,7 +61,7 @@ export const getComponentBindableProperties = (asset, componentId) => {
 /**
  * Gets all data provider components above a component.
  */
-export const getDataProviderComponents = (asset, componentId) => {
+export const getContextProviderComponents = (asset, componentId) => {
   if (!asset || !componentId) {
     return []
   }
@@ -143,7 +143,7 @@ export const getDatasourceForProvider = (asset, component) => {
  */
 const getContextBindings = (asset, componentId) => {
   // Extract any components which provide data contexts
-  const dataProviders = getDataProviderComponents(asset, componentId)
+  const dataProviders = getContextProviderComponents(asset, componentId)
 
   // Generate bindings for all matching components
   return getProviderContextBindings(asset, dataProviders)
diff --git a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/DataSourceSelect.svelte b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/DataSourceSelect.svelte
index bc15110c09..8f5f7ef807 100644
--- a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/DataSourceSelect.svelte
+++ b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/DataSourceSelect.svelte
@@ -1,5 +1,5 @@
 <script>
-  import { getDataProviderComponents } from "builderStore/dataBinding"
+  import { getContextProviderComponents } from "builderStore/dataBinding"
   import {
     Button,
     Popover,
@@ -58,16 +58,19 @@
       ...query,
       type: "query",
     }))
-  $: dataProviders = getDataProviderComponents(
+  $: contextProviders = getContextProviderComponents(
     $currentAsset,
     $store.selectedComponentId
-  ).map(provider => ({
-    label: provider._instanceName,
-    name: provider._instanceName,
-    providerId: provider._id,
-    value: `{{ literal ${safe(provider._id)} }}`,
-    type: "provider",
-  }))
+  )
+  $: dataProviders = contextProviders
+    .filter(component => component._component?.endsWith("/dataprovider"))
+    .map(provider => ({
+      label: provider._instanceName,
+      name: provider._instanceName,
+      providerId: provider._id,
+      value: `{{ literal ${safe(provider._id)} }}`,
+      type: "provider",
+    }))
   $: links = bindings
     .filter(x => x.fieldSchema?.type === "link")
     .map(binding => {
diff --git a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte
index 791380643f..d444f233db 100644
--- a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte
+++ b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte
@@ -3,7 +3,7 @@
   import { store, currentAsset } from "builderStore"
   import { tables } from "stores/backend"
   import {
-    getDataProviderComponents,
+    getContextProviderComponents,
     getSchemaForDatasource,
   } from "builderStore/dataBinding"
   import SaveFields from "./SaveFields.svelte"
@@ -11,7 +11,7 @@
   export let parameters
   export let bindings = []
 
-  $: dataProviderComponents = getDataProviderComponents(
+  $: dataProviderComponents = getContextProviderComponents(
     $currentAsset,
     $store.selectedComponentId
   )