Does not handled NotFoundException in AclAuthorizationStrategyImpl.securityCheck
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Domain
- authorization, security
Research direction
Start with AclAuthorizationStrategyImpl.securityCheck and trace the acl.isGranted call when it raises NotFoundException. Check the surrounding security behavior and existing exception handling; done means the check produces the expected AccessDeniedException instead of allowing NotFoundException to escape.
Written by the indexing model from the issue text.
Description
In case when then currently authenticated user does not have requiredAuthority to change acl then
performed check:
if (acl.isGranted(Arrays.asList(BasePermission.ADMINISTRATION), sids, false)) {
return;
}
but Acl.isGranted may throws NotFoundException and if it will be thrown then AclAuthorizationStrategyImpl.securityCheck does not throw AccessDeniedException as expected.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from spring-projects/spring-security
-
status: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
spring-projects/spring-security#19733 ·
-
status: waiting-for-triage type: enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
spring-projects/spring-security#19730 ·
-
status: waiting-for-triage type: bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
spring-projects/spring-security#19728 ·
-
status: waiting-for-triage type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
spring-projects/spring-security#19725 ·
-
in: build type: task
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
spring-projects/spring-security#19717 ·
All issues in spring-projects/spring-security
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
bug needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
objectionary/hone-maven-plugin#1061 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
spring-projects/spring-modulith#1895 ·