`withContext` can bypass security plugins
- Dominant language
- Java
- Stars
- 5.1k
- Forks
- 1.9k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 46
Description
`ignite.context().security().withContext` function can bypass security plugins!
`ignite.context().security().withContext` should call `authenticate(context: AuthenticationContext)` function!
ignite version: 2.17.0
```kotlin
ignite.context().security().withContext((ignite.cluster().forRemotes().node() ?: ignite.localNode()).id())
// then can query not authenticated cache
val cache = ignite.cache("DataSource")
// this `size` function not call `authenticate(context: AuthenticationContext)`
println("1. //////////////////////////// ${cache.size()}")
try {
// this `forEach` function not call `authenticate(context: AuthenticationContext)`
cache.forEach {
println(it)
}
} catch (e: Exception) {
println("e. ////////////////////////////")
e.printStackTrace()
}
println("2. ////////////////////////////")
```
```kotlin
override fun authenticatedSubject(subjId: UUID): SecuritySubject? {
val n = ctx.discovery().node(subjId)
if (n != null) {
return this.nodeSecurityContext(n)!!.subject()
}
}
private fun nodeSecurityContext(node: ClusterNode): SecurityContextImpl? {
val subjBytesV2 = node.attribute(IgniteNodeAttributes.ATTR_SECURITY_SUBJECT_V2) as ByteArray?
if (subjBytesV2 == null) {
val subj = SecuritySubjectImpl(
node.id(),
SecuritySubjectType.REMOTE_NODE,
address = InetSocketAddress(node.addresses().first(), 0),
permissions = SecurityPermissionSetBuilder.ALL_PERMISSIONS,
nodeId = node.id()
)
return SecurityContextImpl(subj)
} else {
return U.unmarshal(
this.marsh,
subjBytesV2,
U.resolveClassLoader(ctx.config())
) as SecurityContextImpl?
}
}
```
Contributor guide
Research direction
Start at ignite.context().security().withContext and trace the cache.size() and cache.forEach calls in the provided Kotlin reproduction. Compare their security handling with the authenticate(context: AuthenticationContext) entry point and the authenticatedSubject/nodeSecurityContext code shown. Done means these operations cannot bypass the security plugins when invoked through withContext.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100