system:masters tokens are not restricted by scopes
Open
@simo5 is already working on this.
Since Mar 20, 2018.
kind/bug
lifecycle/frozen
priority/P2
sig/security
- Dominant language
- Go
- Stars
- 8.7k
- Forks
- 4.8k
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 53
Description
While trying to build an integration test for webhooks I came up to the fact that a user that uses a token with system:masters in the groups and scopes has scopes completely ignored and full access a system:masters.
This is in master
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.