TSPortal: Any user can forge self-deletion requests for any account

Summary

Conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports.

Details

Creating a DPA report about another user and leaving the evidence field empty causes that report to look like the reported user self-requested deletion of their data. Ingenuine report is not distinguishable from a genuine one.

This can be prevented by disabling convertEmptyStringsToNull in the middleware, or by validating evidence in Http/Controllers/DPAController::store() to not be empty.

PoC

New DPA report -> Select "...someone who I suspect is under the age of 13" for the "The above username is..." field -> Add nothing to the "Evidence" field -> Submit

Impact

Potential unauthorized deletion of any arbitrary user's data both in the current system (TSPortal) and subsequent systems if actioned.