Hi,
When a user sends a Request dict to ReqProxy they include the requested credentials in the task. This is verified to ensure they are an allowed value for the submitter's account:
|
isAuthorized = RequestValidator.setAndCheckRequestOwner(request, self.getRemoteCredentials()) |
|
|
|
if not isAuthorized: |
|
return S_ERROR(DErrno.ENOAUTH, "Credentials in the requests are not allowed") |
|
|
|
forwardable = self.__forwardable(requestDict) |
However if the OwnerGroup is missing from the submitted request, the check passes with any Owner (overwriting the Owner/Group on the Request object). The Request object is then thrown away and the original JSON is stored for execution whatever Owner value was originally included in the requestDict (the OwnerGroup is left as None in the request).
As the permission checks on the called function are keyed by the group properties I don't think this is a security problem, but it would still be good to make it more robust just in-case anything changes in the future.
Regards,
Simon
Hi,
When a user sends a Request dict to ReqProxy they include the requested credentials in the task. This is verified to ensure they are an allowed value for the submitter's account:
DIRAC/src/DIRAC/RequestManagementSystem/Service/ReqProxyHandler.py
Lines 162 to 167 in 6a71b0d
However if the OwnerGroup is missing from the submitted request, the check passes with any Owner (overwriting the Owner/Group on the Request object). The Request object is then thrown away and the original JSON is stored for execution whatever Owner value was originally included in the requestDict (the OwnerGroup is left as None in the request).
As the permission checks on the called function are keyed by the group properties I don't think this is a security problem, but it would still be good to make it more robust just in-case anything changes in the future.
Regards,
Simon