DependencyTrack / DependencyTrack/dependency-track

permission not evaluated correctly

Open
#2,974 0 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

The permissions are not evaluated correctly on MS SQL 16.0 for built-in admin as a managed user.

### Steps to Reproduce

1. Use Master branch at "Merge pull request #2899 from DependencyTrack/nscuro-patch-1"
2. Use MS SQL Server 16.0
3. Assign Permission "PROJECT_CREATION_UPLOAD" to built-in managed user "admin"
4. The evaluation of this permission will fail.
5. See Profiler log: sp_executesql N'SELECT COUNT(A0.ID) FROM PERMISSION A0 INNER JOIN MANAGEDUSERS_PERMISSIONS B0 ON A0.ID = B0.PERMISSION_ID
INNER JOIN MANAGEDUSER C0 ON B0.MANAGEDUSER_ID = C0.ID WHERE C0.ID = @P0 AND A0."NAME" = @P1',
N'@P0 bigint,@P1 varchar(8000)',NULL,'PROJECT_CREATION_UPLOAD'

### Expected Behavior

The built-in admin has the id 1, but you'll find the user parameter to be null.
To get the correct permissions for this managed user, I expect the parameter to have a value of 1.
So the correct permissions would be used.

Code, which produced the query above:

public boolean hasPermission(UserPrincipal user, String permissionName, boolean includeTeams) {
Query query;
if (user instanceof ManagedUser) {
query = this.pm.newQuery(Permission.class, "name == :permissionName && managedUsers.contains(:user)");
} else if (user instanceof LdapUser) {
query = this.pm.newQuery(Permission.class, "name == :permissionName && ldapUsers.contains(:user)");
} else {
query = this.pm.newQuery(Permission.class, "name == :permissionName && oidcUsers.contains(:user)");
}

query.setResult("count(id)");
long count = (Long)query.execute(permissionName, user);

### Dependency-Track Version

4.8.1

### Dependency-Track Distribution

Executable WAR

### Database Server

Microsoft SQL Server

### Database Server Version

16.0

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.