github-advanced-security[bot] commented on code in PR #18718:
URL:
https://github.com/apache/dolphinscheduler/pull/18718#discussion_r4294596373
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ProjectServiceImpl.java:
##########
@@ -521,13 +405,12 @@
*/
@Override
public Result queryAuthorizedProject(User loginUser, Integer userId) {
- Result result = new Result();
-
- List<Project> projects =
projectDao.queryAuthedProjectListByUserId(userId);
- result.setData(projects);
- putMsg(result, Status.SUCCESS);
-
- return result;
+ if (loginUser.getId() == userId) {
Review Comment:
## CodeQL / Reference equality test of boxed types
Suspicious reference comparison of boxed numerical values.
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/5879)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/permission/TaskDatasourcePermissionChecker.java:
##########
@@ -75,13 +74,13 @@
return;
}
- int userId = loginUser.getUserType() == UserType.ADMIN_USER ? 0 :
loginUser.getId();
- Integer[] datasourceIdArray = datasourceIds.toArray(new Integer[0]);
- if (!resourcePermissionCheckService.resourcePermissionCheck(
- AuthorizationType.DATASOURCE, datasourceIdArray, userId, log))
{
- log.warn("User does not have permission to use datasource
referenced by task, userId:{}.",
- loginUser.getId());
- throw new
ServiceException(Status.RESOURCE_NOT_EXIST_OR_NO_PERMISSION);
+ for (Integer datasourceId : datasourceIds) {
+ if (!resourceAuthorizationDao.isAuthorized(projectCode,
ProjectResourceType.DATASOURCE,
+ datasourceId.toString())) {
Review Comment:
## CodeQL / User-controlled bypass of sensitive method
Sensitive method may not be executed depending on a [this condition](1),
which flows from [user-controlled value](2).
Sensitive method may not be executed depending on a [this condition](1),
which flows from [user-controlled value](3).
Sensitive method may not be executed depending on a [this condition](1),
which flows from [user-controlled value](4).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/5878)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java:
##########
@@ -624,113 +566,26 @@
*/
@Override
public void revokeProject(User loginUser, int userId, long projectCode) {
- // 1. only admin can operate
- if (!this.isAdmin(loginUser)) {
- log.warn("Only admin can revoke the project permission.");
- throw new ServiceException(Status.USER_NO_OPERATION_PERM);
- }
-
- // 2. check if user is existed
- User user = this.userDao.queryById(userId);
- if (user == null) {
- log.error("User does not exist, userId:{}.", userId);
- throw new ServiceException(Status.USER_NOT_EXIST, userId);
- }
-
- // 3. check if project is existed
- Project project = this.projectDao.queryByCode(projectCode);
- if (project == null) {
- log.error("Project does not exist, projectCode:{}.", projectCode);
- throw new ServiceException(Status.PROJECT_NOT_FOUND, projectCode);
- }
-
- // 4. delete th relationship between project and user
- this.projectUserDao.deleteProjectRelation(project.getId(),
user.getId());
- log.info("User is revoked permission for projects, userId:{},
projectCode:{}.", userId, projectCode);
+ projectAuthorizationService.replaceMemberPermissions(loginUser,
projectCode, userId, Collections.emptySet());
}
- /**
- * grant namespace
- *
- * @param loginUser login user
- * @param userId user id
- * @param namespaceIds namespace id array
- * @return grant result code
- */
- @Override
- @Transactional
- public void grantNamespaces(User loginUser, int userId, String
namespaceIds) {
- // only admin can operate
- if (!this.isAdmin(loginUser)) {
- log.warn("Only admin can grant namespaces.");
- throw new ServiceException(Status.USER_NO_OPERATION_PERM);
- }
-
- // check exist
- User tempUser = userDao.queryById(userId);
- if (tempUser == null) {
- log.error("User does not exist, userId:{}.", userId);
- throw new ServiceException(Status.USER_NOT_EXIST, userId);
+ private void replaceProjectPermissionsByIds(User loginUser, int userId,
String projectIds,
+ Set<ProjectPermission>
permissions) {
+ if (StringUtils.isEmpty(projectIds)) {
+ return;
}
-
- k8sNamespaceUserMapper.deleteNamespaceRelation(0, userId);
- if (StringUtils.isNotEmpty(namespaceIds)) {
- String[] namespaceIdArr = namespaceIds.split(",");
- for (String namespaceId : namespaceIdArr) {
- Date now = new Date();
- K8sNamespaceUser namespaceUser = new K8sNamespaceUser();
- namespaceUser.setUserId(userId);
- namespaceUser.setNamespaceId(Integer.parseInt(namespaceId));
- namespaceUser.setPerm(7);
- namespaceUser.setCreateTime(now);
- namespaceUser.setUpdateTime(now);
- k8sNamespaceUserMapper.insert(namespaceUser);
+
Arrays.stream(projectIds.split(Constants.COMMA)).distinct().forEach(projectId
-> {
+ Project project =
projectDao.queryDetailById(Integer.parseInt(projectId));
Review Comment:
## CodeQL / Missing catch of NumberFormatException
Potential uncaught 'java.lang.NumberFormatException'.
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/5880)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
