[
https://issues.apache.org/jira/browse/KNOX-3411?focusedWorklogId=1035110&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1035110
]
ASF GitHub Bot logged work on KNOX-3411:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Aug/26 12:59
Start Date: 11/Aug/26 12:59
Worklog Time Spent: 10m
Work Description: hanicz opened a new pull request, #1344:
URL: https://github.com/apache/knox/pull/1344
…a without a caller authorization check
[KNOX-3411](https://issues.apache.org/jira/browse/KNOX-3411) - KnoxToken
getUserTokens returns every user's token metadata without a caller
authorization check
## What changes were proposed in this pull request?
- Bug: any authenticated user could read any/all users' token metadata via
?userName=, ?createdBy=, ?userNameOrCreatedBy=, or ?allTokens=true. No caller
check.
- Fix: in getUserTokens, admins (canSeeAllTokens) get everything; ordinary
callers may only query their own tokens, else 403 + audit log.
## How was this patch tested?
Unit tests.
Locally tested by adding KNOXTOKEN to sandbox topology
```
curl -vku admin:admin-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token?lifespan=P0DT1H0M";
curl -vku tom:tom-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token?lifespan=P0DT1H0M";
curl -vku guest:guest-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token?lifespan=P0DT1H0M";
curl -vk -u guest:guest-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?userNameOrCreatedBy=admin";
curl -vk -u tom:tom-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?userName=guest";
curl -vk -u guest:guest-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?userNameOrCreatedBy=tom";
curl -vk -u guest:guest-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?allTokens=true";
curl -vk -u tom:tom-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?allTokens=true";
curl -vk -u admin:admin-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/getUserTokens?allTokens=true";
```
## Integration Tests
N/A
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1035110)
Remaining Estimate: 0h
Time Spent: 10m
> KnoxToken getUserTokens returns every user's token metadata without a caller
> authorization check
> ------------------------------------------------------------------------------------------------
>
> Key: KNOX-3411
> URL: https://issues.apache.org/jira/browse/KNOX-3411
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 2.1.0, 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Blocker
> Time Spent: 10m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
