andrewmusselman opened a new issue, #667:
URL: https://github.com/apache/tooling-trusted-releases/issues/667
**Audit refs:** 8.3.1 MEDIUM-04
#### Description
`atr/post/projects.py` — the route parameter `name` in the URL is not
validated against `project_name` in the submitted form data. A user could
submit a form targeting a different project than the URL they accessed.
#### Recommended fix
Take this parameter out, don't let the user enter it.
Suggested during audit:
```python
async def _process_add_category(session, add_category_form,
url_project_name):
if add_category_form.project_name != url_project_name:
raise base.ASFQuartException("Project mismatch", errorcode=400)
```
**CWE:** CWE-639
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
