rybakovanton-metta opened a new issue, #12612:
URL: https://github.com/apache/cloudstack/issues/12612
### problem
AccountDaoImpl.findUserAccountByApiKey() constructs a UserVO object using
new UserVO(rs.getLong(1)), which generates a random UUID on every call instead
of reading the user's actual UUID from the database. This causes misleading
error messages where the user UUID changes on every request, making debugging
and log correlation impossible.
The bug is visible when an API permission check fails (e.g.,
UnavailableCommandException), but the random UUID is also propagated to
CallContext for all API-key-authenticated requests, potentially affecting audit
trails and logging even for successful calls.
### versions
main branch (also likely affects 4.19, 4.20 — the code has been this way for
a long time)
API, ACL (Dynamic Role-Based Access Checker)
### The steps to reproduce the bug
Create a non-admin user with API keys
Ensure the user's role does NOT have permission for a specific API (e.g.,
listGpuDevices)
Call the API repeatedly using API key + signature authentication:
curl
"http://<mgmt-server>:8080/client/api?command=listGpuDevices&apikey=<KEY>&signature=<SIG>"
curl
"http://<mgmt-server>:8080/client/api?command=listGpuDevices&apikey=<KEY>&signature=<SIG>"
curl
"http://<mgmt-server>:8080/client/api?command=listGpuDevices&apikey=<KEY>&signature=<SIG>"
Observe the UUID in the error message changes with every request
EXPECTED RESULTS
The user UUID in the error message should be the same on every request,
matching the
user's actual UUID stored in the database:
"The API [listGpuDevices] does not exist or is not available for the account
for user id [<consistent-uuid>]."
ACTUAL RESULTS
Each request returns a different randomly generated UUID:
Request 1: "The API [listGpuDevices] does not exist or is not available for
the account for user id [976292f1-84d7-471d-8fa2-a77b6a4cc466]."
Request 2: "The API [listGpuDevices] does not exist or is not available for
the account for user id [a3b1c2d4-5678-9012-abcd-ef3456789012]."
Request 3: "The API [listGpuDevices] does not exist or is not available for
the account for user id [f1e2d3c4-b5a6-7890-1234-567890abcdef]."
### What to do about it?
AccountDaoImpl.findUserAccountByApiKey() at
engine/schema/src/main/java/com/cloud/user/dao/AccountDaoImpl.java:147 uses a
raw SQL query and manually constructs a UserVO:
User u = new UserVO(rs.getLong(1)); // Constructor generates
UUID.randomUUID()
u.setUsername(rs.getString(2));
u.setAccountId(rs.getLong(3));
u.setSecretKey(DBEncryptionUtil.decrypt(rs.getString(4)));
u.setState(State.getValueOf(rs.getString(5)));
The UserVO(long id) constructor at
engine/schema/src/main/java/com/cloud/user/UserVO.java:125-128:
public UserVO(long id) {
this.id = id;
this.uuid = UUID.randomUUID().toString(); // Random UUID generated here!
}
The SQL query (FIND_USER_ACCOUNT_BY_API_KEY) does not select the uuid
column, and the code never calls u.setUuid() with the database value.
Fix: Add u.uuid to the SQL SELECT and call u.setUuid() when constructing the
UserVO, or use the standard DAO findBy pattern instead of raw SQL.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
