dromara / dromara/dataCompare

[Security] Missing @RequiresPermissions on /system/dbconfig/testConnection endpoint

Open
#15 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
280
Forks
63
PR merge metrics
No merged PRs in 30d

Description

The `/system/dbconfig/testConnection` endpoint is missing the `@RequiresPermissions` annotation, allowing any authenticated user to test database connections regardless of their assigned role.

All other endpoints in `DbConfigController` have proper permission checks:

```java
@RequiresPermissions("system:dbconfig:list") // list
@RequiresPermissions("system:dbconfig:add") // add
@RequiresPermissions("system:dbconfig:edit") // edit
@RequiresPermissions("system:dbconfig:remove") // remove
@RequiresPermissions("system:dbconfig:export") // export

// testConnection — no permission check
@RequestMapping(value = "/testConnection", method = RequestMethod.POST)
public AjaxResult testConnection(Dbconfig dbconfig) { ... }
```

## Impact

- Users with only basic read permissions can call `testConnection` with arbitrary JDBC URLs
- This bypasses the intended role-based access control for database configuration
- Combined with JDBC URL injection, low-privilege users can trigger outbound connections to attacker-controlled servers

## Affected File

https://github.com/dromara/dataCompare/blob/d118e89272f53071ae45ca99ce8e2dddaf836925/src/main/java/com/vince/xq/project/system/dbconfig/controller/DbConfigController.java#L131

## Suggested Fix

Add `@RequiresPermissions("system:dbconfig:edit")` to the `testConnection` method.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.