Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Project resource RPCs do not check that the resource belongs to the request's project

Abierto
  • ¿Algo no está bien?
#2,001 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
go
Área
authorization, backend

Línea de trabajo

Start with the permission rules for the three project resource RPCs in pkg/server/connect_interceptors/authorization.go, then the handlers in internal/api/v1beta1connect/resource.go. Check where each handler takes the project from (the request or the resource row) and compare it with the resource's project. Use the organization resource RPCs that refuse another organization's resource (#1990) as the pattern. Done when all three RPCs reject a resource outside the request's project and DeleteProjectResource works for organization resources.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

GetProjectResource, UpdateProjectResource and DeleteProjectResource take a resource id and a project id, but never check that the resource belongs to that project.

  • UpdateProjectResource loads the project from the request, updates the resource, and writes the app.resource.updated audit log under that project's organization. A caller with update on a resource can send the id of any project, even one they cannot see, and the update goes through with the audit log under that other organization.
  • GetProjectResource returns the resource for any project id.
  • DeleteProjectResource loads the project from the resource row instead. For an organization resource (#1987), which has no project, that lookup fails and the call returns an internal error. Nothing is deleted.

Steps

  1. User A owns resource R in a project of organization O1.
  2. A calls UpdateProjectResource with R's id and the id of a project in organization O2, where A has no access.
  3. The update succeeds, and the app.resource.updated audit log is written under O2.

Code
The authorization rules for these RPCs in pkg/server/connect_interceptors/authorization.go check the permission on the resource and the plan on the request's project. The handlers in internal/api/v1beta1connect/resource.go never compare the request's project with the resource's.

Expected
These RPCs refuse a resource that does not belong to the request's project, the way the organization resource RPCs refuse a resource of another organization (#1990).

Lenguaje dominante
Go
Estrellas
343
Forks
48
Merge medio
2 d 9 h
PR fusionados (30 d)
48

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Tiene una plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de raystack/frontier

Todos los issues de raystack/frontier

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.