synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-03 16:13:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: RBAC should default deny missing variables. (#5105)

Browse Source 
* fix: RBAC should default deny missing variables.

The default behavior was to use 'true' for missing variables. This
was an incorrect assumption. If the variable is missing, the new
default is to deny (fail secure).

* Assert 1 workspace is returned for the owners
This commit is contained in:
Steven Masley
2022-11-16 11:01:09 -06:00
committed by GitHub
parent 1fcc7caf99
commit 015a6f9e26
3 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
coderd/rbac/query.go
View File

@ -470,7 +470,7 @@ func (t opInternalMember2) SQLString(cfg SQLConfig) string {
}
if sqlType == VarTypeSkip {
return "true"
return "false"
}
}

2
coderd/rbac/query_internal_test.go
View File

@ -84,7 +84,7 @@ func TestCompileQuery(t *testing.T) {
`"*" in input.object.acl_group_list["4d30d4a8-b87d-45ac-b0d4-51b2e68e7e75"]`,
))
require.NoError(t, err, "compile")
require.Equal(t, `true`,
require.Equal(t, `false`,
expression.SQLString(NoACLConfig()), "literal dereference")
})
}