checkUserPushPermission is checking the wrong user's permission to push

Abierto Apto para principiantes
  • ¿Algo no está bien?
#1,400 17 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

  • #1713 de @sankalpsthakur — cerrado sin fusionar

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
78/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
git, typescript
Área
backend, security

Línea de trabajo

Lee src/proxy/processors/push-action/parsePush.ts alrededor de las líneas 93-96 y sigue cómo se rellenan user y userEmail de la acción. Confirma que los valores representan al usuario que realiza el proxy push, en lugar del committer del último commit, sin usar action.commitData. Reproduce el escenario de push descrito y verifica que checkUserPushPermission evalúa los detalles del usuario que realiza el push.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug tech-debt

Describe the bug
checkUserPushPermission is intended to check whether the user performing the push is allowed to do so. However, it is currently checking the permission of the committer of the last commit in the push in its current location, rather than the user pushing it into git proxy.

Commits in git are tagged with two users' details: the author (who created the commit and originally pushed it to a repo) and the committer (initially the same as the author, but changes whenever the commit is pushed to a different repository or branch but changes whenever a commit is created or modified (e.g., via git commit, git commit --amend, git rebase, git merge) - git push does NOT change the committer. When we process a push in git proxy, we do so using the original committer of the last commit rather than the user performing the push - which is not the intent of the check.

parsePush is extracting the committer and committerEmail from the last commit in the push and setting them as the user and userEmail in the action object:

https://github.com/finos/git-proxy/blob/6fb63d0597212e9e0056330d3a90df9997f2d505/src/proxy/processors/push-action/parsePush.ts#L93-L96

This is not the correct user information and needs to be corrected in parsePush, without using action.commitData.

To Reproduce

  1. Setup a project in Git proxy where you are allowed to contribute but no other user is
  2. Have a different user push a commit to a branch of the respository.
  3. Clone that branch yourself.
  4. While that different user's commit is the last one on that branch, push the branch to git proxy.
  5. checkUserPushPermission will reject the push as it will use the other user's information as the committer,

Expected behavior
parsePush should use the details of the user trying to push through the proxy as the user and userEmail values of the action (rather than the user that original pushed the last commit), ensuring that checkUserPushPermission checks the correct user's details.

Lenguaje dominante
TypeScript
Estrellas
263
Forks
185
Merge medio
2 d 15 h
PR fusionados (30 d)
39

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de finos/git-proxy

Todos los issues de finos/git-proxy

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.