influxdata / influxdata/influxdb
Authorization is not checked when executing a query
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
It does not seem as if authorization is checked when executing a query. I wrote some end to end tests to validate this and the only thing that seems to be present is that you cannot translate a name to an id if you do not have read authorization, but reading and writing from buckets is not checked.
I have pushed the tests I used to check this to the branch to the [tests/authorization](https://github.com/influxdata/influxdb/blob/tests/authorization/cmd/influxd/launcher/query_test.go) branch.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with cmd/influxd/launcher/query_test.go on the tests/authorization branch and compare its end-to-end authorization checks with query execution behavior. Done means authorization is checked for bucket reads and writes, while retaining the existing name-to-ID read-authorization behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- authorization, databases, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100