apache / apache/ignite

`withContext` can bypass security plugins

Open
#12,005 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
5.1k
Forks
1.9k
Avg merge
3d 2h
Merged PRs (30d)
46

Description

`ignite.context().security().withContext` function can bypass security plugins!

`ignite.context().security().withContext` should call `authenticate(context: AuthenticationContext)` function!

ignite version: 2.17.0

```kotlin
ignite.context().security().withContext((ignite.cluster().forRemotes().node() ?: ignite.localNode()).id())
// then can query not authenticated cache
val cache = ignite.cache("DataSource")
// this `size` function not call `authenticate(context: AuthenticationContext)`
println("1. //////////////////////////// ${cache.size()}")
try {
// this `forEach` function not call `authenticate(context: AuthenticationContext)`
cache.forEach {
println(it)
}
} catch (e: Exception) {
println("e. ////////////////////////////")
e.printStackTrace()
}
println("2. ////////////////////////////")
```
```kotlin
override fun authenticatedSubject(subjId: UUID): SecuritySubject? {
val n = ctx.discovery().node(subjId)
if (n != null) {
return this.nodeSecurityContext(n)!!.subject()
}
}

private fun nodeSecurityContext(node: ClusterNode): SecurityContextImpl? {
val subjBytesV2 = node.attribute(IgniteNodeAttributes.ATTR_SECURITY_SUBJECT_V2) as ByteArray?
if (subjBytesV2 == null) {
val subj = SecuritySubjectImpl(
node.id(),
SecuritySubjectType.REMOTE_NODE,
address = InetSocketAddress(node.addresses().first(), 0),
permissions = SecurityPermissionSetBuilder.ALL_PERMISSIONS,
nodeId = node.id()
)
return SecurityContextImpl(subj)
} else {
return U.unmarshal(
this.marsh,
subjBytesV2,
U.resolveClassLoader(ctx.config())
) as SecurityContextImpl?
}
}
```

Contributor guide

Open the contributing guide

Research direction

Start at ignite.context().security().withContext and trace the cache.size() and cache.forEach calls in the provided Kotlin reproduction. Compare their security handling with the authenticate(context: AuthenticationContext) entry point and the authenticatedSubject/nodeSecurityContext code shown. Done means these operations cannot bypass the security plugins when invoked through withContext.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.