imbajin commented on code in PR #3159:
URL: https://github.com/apache/hugegraph/pull/3159#discussion_r3803711231
##########
hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/auth/HugeGraphAuthProxy.java:
##########
@@ -2461,4 +2518,36 @@ public String toString() {
return this.origin.toString();
}
}
+
+ private static Set<HugePermission> traversalPermissions(
+ Traversal.Admin<?, ?> traversal) {
+ Set<HugePermission> permissions = EnumSet.noneOf(HugePermission.class);
+ collectTraversalPermissions(traversal, permissions);
+ return permissions;
+ }
+
+ private static void collectTraversalPermissions(
+ Traversal.Admin<?, ?> traversal,
+ Set<HugePermission> permissions) {
+ for (Step<?, ?> step : traversal.getSteps()) {
+ if (step instanceof AddVertexStartStep ||
Review Comment:
‼️ Critical: This condition lists every step treated as a mutation, but
omits TinkerPop 3.7.6's `MergeVertexStep` and `MergeEdgeStep`. A merge
traversal with `onMatch` can update an existing vertex/edge through
`property(...)` while the new pre-check sees no WRITE permission; the existing
element iterator returns raw graph elements, so the later property call is not
protected by the proxy's direct `addVertexProperty`/`addEdgeProperty` methods.
Please include both merge step classes in the WRITE set, recurse through their
child traversals, and add execute-only regression tests for both create and
onMatch paths.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
