DependencyTrack / DependencyTrack/dependency-track
permission not evaluated correctly
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
The permissions are not evaluated correctly on MS SQL 16.0 for built-in admin as a managed user.
### Steps to Reproduce
1. Use Master branch at "Merge pull request #2899 from DependencyTrack/nscuro-patch-1"
2. Use MS SQL Server 16.0
3. Assign Permission "PROJECT_CREATION_UPLOAD" to built-in managed user "admin"
4. The evaluation of this permission will fail.
5. See Profiler log: sp_executesql N'SELECT COUNT(A0.ID) FROM PERMISSION A0 INNER JOIN MANAGEDUSERS_PERMISSIONS B0 ON A0.ID = B0.PERMISSION_ID
INNER JOIN MANAGEDUSER C0 ON B0.MANAGEDUSER_ID = C0.ID WHERE C0.ID = @P0 AND A0."NAME" = @P1',
N'@P0 bigint,@P1 varchar(8000)',NULL,'PROJECT_CREATION_UPLOAD'
### Expected Behavior
The built-in admin has the id 1, but you'll find the user parameter to be null.
To get the correct permissions for this managed user, I expect the parameter to have a value of 1.
So the correct permissions would be used.
Code, which produced the query above:
public boolean hasPermission(UserPrincipal user, String permissionName, boolean includeTeams) {
Query query;
if (user instanceof ManagedUser) {
query = this.pm.newQuery(Permission.class, "name == :permissionName && managedUsers.contains(:user)");
} else if (user instanceof LdapUser) {
query = this.pm.newQuery(Permission.class, "name == :permissionName && ldapUsers.contains(:user)");
} else {
query = this.pm.newQuery(Permission.class, "name == :permissionName && oidcUsers.contains(:user)");
}
query.setResult("count(id)");
long count = (Long)query.execute(permissionName, user);
### Dependency-Track Version
4.8.1
### Dependency-Track Distribution
Executable WAR
### Database Server
Microsoft SQL Server
### Database Server Version
16.0
### Browser
Google Chrome
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.