cloudfoundry / cloudfoundry/stratos
Permissions incorrectly allows actions if Cf Admin
Open
Nobody has claimed this yet.
bug
- Dominant language
- TypeScript
- Stars
- 267
- Forks
- 137
- Avg merge
- 5h 14m
- Merged PRs (30d)
- 77
Description
Note - this is a usability issue rather than security. Everything is executed/retrieved via the CF API so said actions will ultimately fail
- Actions (view space, add cf user role, stratos password change, etc) are allowed via a group of permissions.
- If an endpoint guid is supplied to the permissions checker... When permissions are combined to get an eventual true/false value any result is overwritten by their cf endpoint admin status
- So if user is not a space or org manager.. they are an admin so will be allowed to execute the action
- However if something is mixed in that is independent of admin status, such as a feature flag check, then the permission incorrectly results in true if admin.
Fix Notes
- See
src/frontend/packages/core/src/core/current-user-permissions.service.tscombineChecks - Think we need to add an 'allowAdminOverride
or something toICheckCombinerwhich can then be used incombineChecks`
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with src/frontend/packages/core/src/core/current-user-permissions.service.ts and inspect combineChecks, then trace the ICheckCombiner definition and its callers. Verify how endpoint-admin results interact with independent checks such as feature flags; the issue is done when admin status no longer incorrectly makes those combined checks true.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authorization, frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100