Serge Huber created UNOMI-976:
---------------------------------
Summary: Restrict Groovy action upload to system administrators
Key: UNOMI-976
URL: https://issues.apache.org/jira/browse/UNOMI-976
Project: Apache Unomi
Issue Type: Improvement
Components: unomi(-core)
Affects Versions: unomi-3.1.0
Reporter: Serge Huber
Assignee: Serge Huber
Fix For: unomi-3.1.0
h2. Current behaviour
The Groovy actions endpoint is reachable by any authenticated caller, including
a tenant
administrator. Uploading a Groovy action is a host-impacting operation — script
compilation and
execution in the server process — and is not confined to a tenant's data plane.
h2. Change
* {{GroovyActionsEndPoint}} requires {{UnomiRoles.ADMINISTRATOR}}.
* {{GroovyActionsServiceImpl}} compiles through
{{GroovyClassLoader.parseClass(codeSource, false)}}
instead of {{GroovyShell.parse}}. The latter instantiates the script, which
runs {{@Field}}
initialisers at *compile* time. The emitted bytecode is otherwise identical.
h2. Tests
* {{GroovyActionsEndPointRoleTest}} — the role annotation is present.
* {{GroovyActionsServiceImplTest}} — including
{{fieldInitializerAction.groovy}}, which proves
compilation no longer executes field initialisers.
* {{GroovyActionsEndpointRoleSecurityIT}} — HTTP-level checks that a tenant
private key is rejected
on both the plain and multipart-upload paths.
h2. Backport
Not required. 3.0.x and 2.7.x already gate this endpoint through
{{AuthorizingInterceptor}}'s
admin-only {{globalRoles}}; only 3.1's finer-grained role split reopened it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
