重要安全漏洞: 飞书cli/lark-cli可以无视"密级标签"读取文档
Open
Nobody has claimed this yet.
bug
domain/core
domain/doc
- Dominant language
- Go
- Stars
- 17.3k
- Forks
- 1.4k
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 105
Description
密级标签参考飞书官方文档：
https://www.feishu.cn/hc/zh-CN/articles/681363834397-%E7%AE%A1%E7%90%86%E5%91%98%E8%AE%BE%E7%BD%AE%E5%AF%86%E7%BA%A7%E6%A0%87%E7%AD%BE
使用飞书cli版本: v1.0.89
个人在飞书中无法读取的附带"密级标签"的文档,可以通过lark-doc skill直接读取文档全文
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
First reproduce the report with CLI v1.0.89: compare access to a Feishu document with a 密级标签 through Feishu and the lark-doc skill. Then trace the lark-doc document-reading path and its access checks. Done means restricted documents are not returned through the CLI, with the behavior verified against the reported scenario.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100