Skip to content
This repository was archived by the owner on Mar 4, 2026. It is now read-only.
This repository was archived by the owner on Mar 4, 2026. It is now read-only.

Block exposing private keys #1984

@abhishekwebcode

Description

@abhishekwebcode

Please see suggested Pull Request #1983 for the fix

Environment details

  • OS: MacOS
  • Node.js version:
  • npm version: 21.5.0
  • @google-cloud/firestore version: 7.2.0

Steps to reproduce

  1. Install the latest version of this library from https://www.npmjs.com/package/@google-cloud/firestore
  2. Initialise the firestore object using a JSON private key (Service Account)
  3. Get any object like the original firestore object or Make a WriteBatch, CollectionReference, DocumentSnapshot
  4. Run JSON.stringify() method on any object obtained in the step above (3), the private key is exposed because the spelling of toJSON method in https://github.com/googleapis/nodejs-firestore/blob/main/dev/src/index.ts#L748 is not correct
    it should be toJSON instead of toJson, so the method is not getting activated which was meant to prevent serialisation of internal this._settings object when the firestore object is being serialised via JSON.stringify

Metadata

Metadata

Assignees

Labels

api: firestoreIssues related to the googleapis/nodejs-firestore API.priority: p2Moderately-important priority. Fix may not be included in next release.type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions