alibaba / alibaba/Sentinel

ACL check auth bugs when http method is post or put , which the params can not get from request.getParams() method

Open
#1,652 0 comments 0 reactions 0 assignees View on GitHub
area/dashboard
Dominant language
Java
Stars
23.1k
Forks
8.1k
PR merge metrics
No merged PRs in 30d

Description

## Issue Description

thanks for #1042 contribute 👍 , which provide the @AuthAction to solve the privilege of method ; but when the http params path through http body , the com.alibaba.csp.sentinel.dashboard.auth.AuthorizationInterceptor current is not ok to check auth correctly.

Type: *bug report*

### Describe what happened

I created my own AuthService , and extend auth mehod as my own demand , it works . 😄 but when the http method is post ,put , params path through http body , it not works . such an /v1/flow/rule , /paramFlow/rule and so on.

### Describe what you expected to happen

check auth correctly .

### How to reproduce it (as minimally and precisely as possible)

1. change com.alibaba.csp.sentinel.dashboard.auth.SimpleWebAuthServiceImpl.SimpleWebAuthUserImpl#authTarget code
. add the below code

``` java
//target is the app name , this method to check the app has the PrivilegeType by your own demand.
//when the target is null , return false to deny
if( null == target){
return false;
}
```

2. start or debug DashboardApplication ;
3. find one resource and add a rule ; which method is /v1/flow/rule . the result is "Permission denied" .

### Tell us your environment
jdk 1.8 ,the master branch , the release-1.7 branch is the same result .

### Anything else we need to know?

none .

Contributor guide

Open the contributing guide

Research direction

Start in com.alibaba.csp.sentinel.dashboard.auth.AuthorizationInterceptor and inspect how it obtains parameters for POST and PUT requests before calling SimpleWebAuthServiceImpl.SimpleWebAuthUserImpl#authTarget. Reproduce the failure by running DashboardApplication and adding a rule through /v1/flow/rule; done means authorization succeeds when parameters are sent in the HTTP body.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, authorization, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.