Copilot commented on code in PR #14104:
URL: https://github.com/apache/cloudstack/pull/14104#discussion_r3995753959
##########
server/src/main/java/com/cloud/user/AccountManagerImpl.java:
##########
@@ -3436,6 +3437,10 @@ private Boolean isAccessingKeypairSuperset(ApiKeyPair
accessedKeyPair, BaseCmd c
return Boolean.TRUE;
}
ApiKeyPair accessingKeyPair = apiKeyPairService.findByApiKey(apiKey);
+ if (accessingKeyPair == null) {
+ logger.info("Unable to find the API key pair used to access the
API; therefore, its permissions cannot be verified.");
+ return Boolean.FALSE;
Review Comment:
On the integration port, `ApiServer.handle` registers the system context and
does not authenticate the request; the CLI still sends its dummy `apikey`, so
`getAccessingApiKey(cmd)` returns `dummy`. This lookup is null and returning
`false` makes `getKeys` suppress the fallback pair at lines 3332–3334,
replacing the NPE with a response containing null keys rather than the admin
keys described in the PR. Please distinguish integration-port/system calls from
an invalid signed API key and allow the intended fallback only for the former,
with a regression test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
