intent: a print feeder endpoint (<Name>PrintFeeder/{id}) has no role gate - a user with no role reads any document
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 47/100
Research direction
Start with PrintFeeder.java.template and compare its generated GET endpoint with the REST controller’s read gate and PermissionSupport, including how access.extraRoles and extraRolesReadOnly are applied. Check the related work in #7913 and the tests for feeder authorization and nonexistent IDs. Done means unauthorized callers receive 403 before the root record is loaded, with the open question about related-node permissions resolved and covered.
Written by the indexing model from the issue text.
Description
Problem
The class generated for a print feeder, gen/events/<module>/<Name>PrintFeeder.java from PrintFeeder.java.template, serves GET .../<Name>PrintFeeder/{id} with no role gate. It has no @Roles and no in-code check. It loads the root record by id and returns it with its related records as JSON.
So any signed-in user, including one with no role at all, can read a document that the root entity's own REST controller refuses them with 403. The response is 200 with an empty body ({}) for an id that does not exist, so the endpoint also tells the caller which ids exist.
This was found next to #7913, which gates <Name>Generate/run and <Name>Transition/run. That fix deliberately stays to the two write endpoints.
Expected
The feeder demands the root entity's read gate, as PermissionSupport computes it for the controllers: the can: grants or the convention ReadOnly/FullAccess roles, with access.extraRoles and extraRolesReadOnly appended. A caller without it gets 403 before the root is loaded.
An open question is whether each related node (via a foreign key, possibly cross-model) should also demand its own read gate, or whether reading the document implies reading what it prints.
- Dominant language
- Java
- Stars
- 278
- Forks
- 97
- Avg merge
- 18h 53m
- Merged PRs (30d)
- 228
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from eclipse-dirigible/dirigible
-
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
eclipse-dirigible/dirigible#7958 ·
Maintainers usually reply within 1 day
-
intent: a create-from without fromStatus answers 200 on a missing or unknown source id (no 400/404)Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
eclipse-dirigible/dirigible#7945 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
eclipse-dirigible/dirigible#7891 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
eclipse-dirigible/dirigible#6538 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
eclipse-dirigible/dirigible#4812 ·
Maintainers usually reply within 1 day
All issues in eclipse-dirigible/dirigible
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
apache/rocketmq-dashboard#7250 ·
Maintainers usually reply within 3 days
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
ignatov/intellij-erlang#1093 ·
-
HttpMaxFrameSizeTest.sendOversizedMessageTest() passes silently when maxFrameSize is not enforcedOpen
Difficulty 1/5 Under an hour Newbie friendliness 90/100
apache/activemq#2706 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
federicoiosue/Omni-Notes#1032 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
unitycatalog/unitycatalog#2025 ·
Maintainers usually reply within 4 days