nspcc-dev / nspcc-dev/neofs-node
Static session tokens are silently mutated by CLI
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 38
- Forks
- 51
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 38
Description
currently, NeoFS CLI completes and signs session tokens in commands
$ neofs-cli object put --session token.json
and
$ neofs-cli object delete --session token.json
the token is finalized unconditionally: even if it is signed, it is mutated. The problem occured in testsuite:
- in previous revision, CLI re-signed specified token which led to issuer's rewrite (then this session led to
Access Denied) - in current revision, CLI also re-signs the token, but now it doesn't rewrite issuer (this seems correct, but due to this so we see
invalid session token owner)
Proposal
from my pov, current behavior with silent invasion is incorrect, and i propose to require tokens specified via --session to be correctly formed and signed (*) because static sessions are going from the outworld and MUST NOT be modified by CLI
(*) we provide util sign session-token for this
overall, I'd make NeoFS CLI to not touch user input at all except some UI translations like public-read-write -> uint32
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the neofs-cli object put and object delete commands, focusing on how --session input is handled; compare this with util sign session-token and the linked testsuite failure. Done means a correctly signed static session token is accepted without CLI mutation, with coverage for both commands and invalid or unsigned input behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, distributed-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100