kwin commented on a change in pull request #291:
URL: https://github.com/apache/jackrabbit-oak/pull/291#discussion_r622257772
##########
File path:
oak-jcr/src/main/java/org/apache/jackrabbit/oak/jcr/session/SessionImpl.java
##########
@@ -248,11 +249,15 @@ public String getUserID() {
public String[] getAttributeNames() {
Set<String> names =
newTreeSet(sessionContext.getAttributes().keySet());
Collections.addAll(names, sd.getAuthInfo().getAttributeNames());
+ names.add(RepositoryImpl.BOUND_PRINCIPALS);
return names.toArray(new String[names.size()]);
}
@Override
public Object getAttribute(String name) {
+ if (RepositoryImpl.BOUND_PRINCIPALS.equals(name)) {
Review comment:
That is IMHO dangerous, as the bound principals can be used for checking
if certain code paths should be allowed (e.g. in the context of FileVault). If
someone can forge these attributes by just creating a (otherwise restriced)
session with those parameters, this could easily be abused for privilege
escalation. IMHO those values should not be allowed to be overwritten by
consumers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
