Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Project resource RPCs do not check that the resource belongs to the request's project

Aperta
  • Qualcosa non va?
#2,001 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
go
Ambito
authorization, backend

Direzione di ricerca

Start with the permission rules for the three project resource RPCs in pkg/server/connect_interceptors/authorization.go, then the handlers in internal/api/v1beta1connect/resource.go. Check where each handler takes the project from (the request or the resource row) and compare it with the resource's project. Use the organization resource RPCs that refuse another organization's resource (#1990) as the pattern. Done when all three RPCs reject a resource outside the request's project and DeleteProjectResource works for organization resources.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

GetProjectResource, UpdateProjectResource and DeleteProjectResource take a resource id and a project id, but never check that the resource belongs to that project.

  • UpdateProjectResource loads the project from the request, updates the resource, and writes the app.resource.updated audit log under that project's organization. A caller with update on a resource can send the id of any project, even one they cannot see, and the update goes through with the audit log under that other organization.
  • GetProjectResource returns the resource for any project id.
  • DeleteProjectResource loads the project from the resource row instead. For an organization resource (#1987), which has no project, that lookup fails and the call returns an internal error. Nothing is deleted.

Steps

  1. User A owns resource R in a project of organization O1.
  2. A calls UpdateProjectResource with R's id and the id of a project in organization O2, where A has no access.
  3. The update succeeds, and the app.resource.updated audit log is written under O2.

Code
The authorization rules for these RPCs in pkg/server/connect_interceptors/authorization.go check the permission on the resource and the plan on the request's project. The handlers in internal/api/v1beta1connect/resource.go never compare the request's project with the resource's.

Expected
These RPCs refuse a resource that does not belong to the request's project, the way the organization resource RPCs refuse a resource of another organization (#1990).

Lingua principale
Go
Stelle
343
Fork
48
Merge medio
2g 9h
PR unite (30g)
48

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di raystack/frontier

Tutte le issue di raystack/frontier

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.