Azure / Azure/data-api-builder
[Bug]: REST unexpected authorization error when excluding primary key and using orderby
- Langage dominant
- C#
- Étoiles
- 1.5k
- Forks
- 370
- Merge moyen
- 3 j 22 h
- PR mergées (30 j)
- 9
Description
### What happened?
If a primary key is excluded through the `actions.fields.exclude` property an authorization error occurs when the `orderby` clause is used in the request, even if the field used in the `orderby` is authorized.
Configuration file: In this case `id` is a primary key
```
"Book": {
"permissions": [
{
"role": "anonymous",
"actions": [
{
"action": "create"
},
{
"action": "read",
"fields": {
"include": [ "*" ],
"exclude": [ "id" ]
},
"policy": {
"database": "id gt 2"
}
}
}
```
REST request used: ` https://localhost:5001/api/Book?$orderby=title asc`
### Version
1.6.68
### What database are you using?
Azure SQL
### What hosting model are you using?
_No response_
### Which API approach are you accessing DAB through?
REST
### Relevant log output
```Text
fail: Azure.DataApiBuilder.Service.Controllers.RestController[0]
71916690-677b-4638-a837-b2e7eaa8fee6 Error handling REST request.
Azure.DataApiBuilder.Service.Exceptions.DataApiBuilderException: Authorization Failure: Access Not Allowed.
at Azure.DataApiBuilder.Core.Services.RestService.AuthorizationCheckForRequirementAsync(Object resource, IAuthorizationRequirement requirement) in C:\Users\rcernaserna\DAB\data-api-builder\src\Core\Services\RestService.cs:line 508
at Azure.DataApiBuilder.Core.Services.RestService.ExecuteAsync(String entityName, EntityActionOperation operationType, String primaryKeyRoute) in C:\Users\rcernaserna\DAB\data-api-builder\src\Core\Services\RestService.cs:line 189
at Azure.DataApiBuilder.Service.Controllers.RestController.HandleOperation(String route, EntityActionOperation operationType) in C:\Users\rcernaserna\DAB\data-api-builder\src\Service\Controllers\RestController.cs:line 239
```
### Code of Conduct
- [x] I agree to follow this project's Code of Conduct
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Commencez dans src/Core/Services/RestService.cs, autour de la vérification de l’autorisation à la ligne 508, puis suivez le flux de la requête dans src/Service/Controllers/RestController.cs à la ligne 239. Reproduisez la requête REST avec actions.fields.exclude défini sur id et orderby=title asc ; c’est terminé lorsque la requête orderby autorisée réussit sans erreur d’autorisation, tandis que la clé primaire reste exclue.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- azure, csharp, sql
- Domaine
- api, authorization, databases
- Type d'issue
- Bug
- Difficulté
- 3/5
- Temps estimé
- 1-2 jours
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 45/100